Description
A vulnerability in the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to induce a Denial-of-Service (DoS) condition on the device via multiple crafted HTTP requests. In the worst case, a full power cycle is needed to regain control of the device.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Bosch Rexroth | ctrlX OS - Device Admin | 1.12.0 – ≤ 1.12.9, 1.20.0 – ≤ 1.20.7, 2.6.0 – ≤ 2.6.8 | — |
Advisories 1
- VDE-2025-040 WAGO: Vulnerabilities in ctrlX OS app CERT@VDE · Jun 16, 2025
References
- https://psirt.bosch.com/security-advisories/BOSCH-SA-640452.html vendor-advisory