CVE-2025-48862: high-severity vulnerability in Bosch Rexroth AG ctrlX OS - Setup
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The ctrlX OS setup tool's interface misleads users into thinking their backup files are fully encrypted when they set a password, but only the private key inside is encrypted—the rest of the backup data remains unprotected and exposed.
A UI clarity issue in ctrlX OS backup mechanism creates a false sense of security; while password entry suggests full-file encryption, only embedded private keys are encrypted via CWE-311 (missing encryption), leaving sensitive backup contents readable. An attacker with access to the backup file can extract unencrypted data despite password configuration.
In the same product, most dangerous first.