CVE-2025-48861: Bosch Rexroth AG Ctrlx OS - Setup

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to access and extract internal application data, including potential debug logs and the version of installed apps.

Affected products

• Bosch Rexroth AG Ctrlx OS - Setup: from 1.20.0, up to and including 1.20.1; from 2.6.0, up to and including 2.6.1; from 3.6.0, up to and including 3.6.2

Published 2025-08-14. Last modified 2026-06-17.