CVE-2023-48243 - The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request

Back Back to CVE browser

HIGH

The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request

Published Jan 10, 2024

8.8

HIGH

CVSS 3.1

EPSS 1.09%

Description

The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By abusing this vulnerability, it is possible to obtain remote code execution (RCE) with root privileges on the device.

Affected products

Vendor Rexroth Product Nexo cordless nutrunner NXA011S-36V (0608842011) Default
unknown
Affected
- ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Vendor Rexroth Product Nexo cordless nutrunner NXA011S-36V-B (0608842012) Default
unknown
Affected
- ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Vendor Rexroth Product Nexo cordless nutrunner NXA015S-36V (0608842001) Default
unknown
Affected
- ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Vendor Rexroth Product Nexo cordless nutrunner NXA015S-36V-B (0608842006) Default
unknown
Affected
- ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Vendor Rexroth Product Nexo cordless nutrunner NXA030S-36V (0608842002) Default
unknown
Affected
- ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Vendor Rexroth Product Nexo cordless nutrunner NXA030S-36V-B (0608842007) Default
unknown
Affected
- ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Vendor Rexroth Product Nexo cordless nutrunner NXA050S-36V (0608842003) Default
unknown
Affected
- ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Vendor Rexroth Product Nexo cordless nutrunner NXA050S-36V-B (0608842008) Default
unknown
Affected
- ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Vendor Rexroth Product Nexo cordless nutrunner NXA065S-36V (0608842013) Default
unknown
Affected
- ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Vendor Rexroth Product Nexo cordless nutrunner NXA065S-36V-B (0608842014) Default
unknown
Affected
- ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Vendor Rexroth Product Nexo cordless nutrunner NXP012QD-36V (0608842005) Default
unknown
Affected
- ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Vendor Rexroth Product Nexo cordless nutrunner NXP012QD-36V-B (0608842010) Default
unknown
Affected
- ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Vendor Rexroth Product Nexo cordless nutrunner NXV012T-36V (0608842015) Default
unknown
Affected
- ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Vendor Rexroth Product Nexo cordless nutrunner NXV012T-36V-B (0608842016) Default
unknown
Affected
- ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Vendor Rexroth Product Nexo special cordless nutrunner (0608PE2272) Default
unknown
Affected
- ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Vendor Rexroth Product Nexo special cordless nutrunner (0608PE2301) Default
unknown
Affected
- ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Vendor Rexroth Product Nexo special cordless nutrunner (0608PE2514) Default
unknown
Affected
- ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Vendor Rexroth Product Nexo special cordless nutrunner (0608PE2515) Default
unknown
Affected
- ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Vendor Rexroth Product Nexo special cordless nutrunner (0608PE2666) Default
unknown
Affected
- ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Vendor Rexroth Product Nexo special cordless nutrunner (0608PE2673) Default
unknown
Affected
- ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Rexroth	Nexo cordless nutrunner NXA011S-36V (0608842011)	unknown	Affected ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Rexroth	Nexo cordless nutrunner NXA011S-36V-B (0608842012)	unknown	Affected ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Rexroth	Nexo cordless nutrunner NXA015S-36V (0608842001)	unknown	Affected ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Rexroth	Nexo cordless nutrunner NXA015S-36V-B (0608842006)	unknown	Affected ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Rexroth	Nexo cordless nutrunner NXA030S-36V (0608842002)	unknown	Affected ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Rexroth	Nexo cordless nutrunner NXA030S-36V-B (0608842007)	unknown	Affected ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Rexroth	Nexo cordless nutrunner NXA050S-36V (0608842003)	unknown	Affected ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Rexroth	Nexo cordless nutrunner NXA050S-36V-B (0608842008)	unknown	Affected ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Rexroth	Nexo cordless nutrunner NXA065S-36V (0608842013)	unknown	Affected ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Rexroth	Nexo cordless nutrunner NXA065S-36V-B (0608842014)	unknown	Affected ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Rexroth	Nexo cordless nutrunner NXP012QD-36V (0608842005)	unknown	Affected ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Rexroth	Nexo cordless nutrunner NXP012QD-36V-B (0608842010)	unknown	Affected ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Rexroth	Nexo cordless nutrunner NXV012T-36V (0608842015)	unknown	Affected ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Rexroth	Nexo cordless nutrunner NXV012T-36V-B (0608842016)	unknown	Affected ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Rexroth	Nexo special cordless nutrunner (0608PE2272)	unknown	Affected ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Rexroth	Nexo special cordless nutrunner (0608PE2301)	unknown	Affected ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Rexroth	Nexo special cordless nutrunner (0608PE2514)	unknown	Affected ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Rexroth	Nexo special cordless nutrunner (0608PE2515)	unknown	Affected ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Rexroth	Nexo special cordless nutrunner (0608PE2666)	unknown	Affected ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2
Rexroth	Nexo special cordless nutrunner (0608PE2673)	unknown	Affected ≥ NEXO-OS V1000-Release, ≤ NEXO-OS V1500-SP2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-52312
Advisory
https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-52312		Advisory
https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html		vendor-advisoryVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner bosch

Published Jan 10, 2024

Updated Jun 17, 2025

Reserved Nov 13, 2023

Link CVE-2023-48243

CISA Vulnrichment

Updated Jan 10, 2024

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-48243

Red Hat

No data

ENISA EUVD

Assigner bosch

Published Jan 10, 2024

Updated Jun 17, 2025

Link EUVD-2023-52312

GitHub

No data