CVE-2023-48243

The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By abusing this vulnerability, it is possible to obtain remote code execution (RCE) with root privileges on the device.

Score

CVSS 3.1 8.8 High

Status

Modified - psirt@bosch.com

Published

2024-01-10

Last modified

2025-06-17

Weaknesses

CWE-22

Affected products

• Nexo-os (Bosch)
• Nexo Cordless Nutrunner Nxa011s-36v-b 0608842012 (Rexroth)
• Nexo Cordless Nutrunner Nxa011s-36v 0608842011 (Rexroth)
• Nexo Cordless Nutrunner Nxa015s-36v-b 0608842006 (Rexroth)
• Nexo Cordless Nutrunner Nxa015s-36v 0608842001 (Rexroth)
• Nexo Cordless Nutrunner Nxa030s-36v-b 0608842007 (Rexroth)
• Nexo Cordless Nutrunner Nxa030s-36v 0608842002 (Rexroth)
• Nexo Cordless Nutrunner Nxa050s-36v-b 0608842008 (Rexroth)
• Nexo Cordless Nutrunner Nxa050s-36v 0608842003 (Rexroth)
• Nexo Cordless Nutrunner Nxa065s-36v-b 0608842014 (Rexroth)
• Nexo Cordless Nutrunner Nxa065s-36v 0608842013 (Rexroth)
• Nexo Cordless Nutrunner Nxp012qd-36v-b 0608842010 (Rexroth)
• Nexo Cordless Nutrunner Nxp012qd-36v 0608842005 (Rexroth)
• Nexo Cordless Nutrunner Nxv012t-36v-b 0608842016 (Rexroth)
• Nexo Cordless Nutrunner Nxv012t-36v 0608842015 (Rexroth)
• Nexo Special Cordless Nutrunner 0608pe2272 (Rexroth)
• Nexo Special Cordless Nutrunner 0608pe2301 (Rexroth)
• Nexo Special Cordless Nutrunner 0608pe2514 (Rexroth)
• Nexo Special Cordless Nutrunner 0608pe2515 (Rexroth)
• Nexo Special Cordless Nutrunner 0608pe2666 (Rexroth)
• Nexo Special Cordless Nutrunner 0608pe2673 (Rexroth)

References

• https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html