First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-24338

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to execute arbitrary client-side code in the context of another user's browser via multiple crafted HTTP requests.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Bosch Rexroth AG	ctrlX OS - Solutions	>= 1.12.0, <= 1.12.1; >= 1.20.0, <= 1.20.1; >= 2.6.0, <= 2.6.0

References

https://psirt.bosch.com/security-advisories/BOSCH-SA-640452.html

Timeline

Published: Apr 30, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-243395.0A vulnerability in the web application of ctrlX OS allows a remote unauthenticated attacker to conduct various attacks against users of the CVE-2025-243406.5A vulnerability in the users configuration file of ctrlX OS may allow a remote authenticated (low-privileged) attacker to recover the plaint CVE-2025-243416.5A vulnerability in the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to induce a Denial-of-Service (Do CVE-2025-243425.3A vulnerability in the login functionality of the web application of ctrlX OS allows a remote unauthenticated attacker to guess valid userna CVE-2025-243435.4A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) at CVE-2025-243446.3A vulnerability in the error notification messages of the web application of ctrlX OS allows a remote unauthenticated attacker to inject arb CVE-2025-243456.3A vulnerability in the “Hosts” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to m CVE-2025-243467.5A vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to ma CVE-2025-243476.5A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) CVE-2025-243485.4A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) CVE-2025-243497.1A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) a CVE-2025-243507.1A vulnerability in the “Certificates and Keys” functionality of the web application of ctrlX OS allows a remote authenticated (low-privilege

CVE-2025-24338: High severity, CVSS 7.1 | Vulnix