CVE-2025-48862

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set. However, only the private key - if available in the backup - is encrypted, while the backup file itself remains unencrypted.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-311 CWE-1104

Affected software

Vendor	Product	Versions
Bosch Rexroth AG	ctrlX OS - Setup	>= 1.20.0, <= 1.20.1; >= 2.6.0, <= 2.6.1; >= 3.6.0, <= 3.6.2

References

https://psirt.bosch.com/security-advisories/BOSCH-SA-129652.html

Timeline

Published: Aug 14, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-488659.1Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. Prior to version 1.6.6, Fabio allows clients to remove X-Fo CVE-2025-488667.5ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 cont CVE-2025-488674.8Horilla is a free and open source Human Resource Management System (HRMS). A stored cross-site scripting (XSS) vulnerability in Horilla HRM CVE-2025-488687.2Horilla is a free and open source Human Resource Management System (HRMS). An authenticated Remote Code Execution (RCE) vulnerability exists CVE-2025-488697.5Horilla is a free and open source Human Resource Management System (HRMS). Unauthenticated users can access uploaded resume files in Horilla CVE-2025-48878.8A vulnerability, which was classified as problematic, has been found in SourceCodester Online Student Clearance System 1.0. Affected by this CVE-2025-488755.4FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.181, the system's incorrect validation of last_name and f CVE-2025-488779.8Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, an CVE-2025-488784.3Combodo iTop is a web based IT service management tool. In versions on the 3.x branch prior to 3.2.2, an insecure direct object reference al CVE-2025-488796.5OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows any unauthenticated attacker to send a manipulated brok CVE-2025-48887.8A vulnerability, which was classified as critical, was found in code-projects Pharmacy Management System 1.0. This affects the function medi CVE-2025-488806.6FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.181, when an administrative account is a deleting a user,