{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-us",
    "notes": [
      {
        "category": "summary",
        "text": "Trend Micro identified multiple vulnerabilities in Rexroth IndraWorks and bundled utilities. In the worst case, exploitation may result in remote code execution.",
        "title": "Summary"
      },
      {
        "category": "details",
        "text": "Vulnerability classification has been performed using the CVSS v3.1 scoring system. The CVSS environmental score is specific to each customer's environment and should be defined by the customer to attain a final scoring.",
        "title": "CVSS Scoring"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@bosch.com",
      "issuing_authority": "Robert Bosch GmbH",
      "name": "Robert Bosch GmbH",
      "namespace": "https://psirt.bosch.com"
    },
    "references": [
      {
        "category": "external",
        "summary": "Source Bosch PSIRT advisory (HTML)",
        "url": "https://psirt.bosch.com/security-advisories/bosch-sa-591522.html"
      },
      {
        "category": "external",
        "summary": "Bosch Rexroth OPC DA Client download",
        "url": "https://www.boschrexroth.com/de/de/media-details/2f969694-b755-407f-9d02-8f86aee0e98c"
      },
      {
        "category": "external",
        "summary": "Bosch Rexroth Collaboration Rooms (UA.TestClient)",
        "url": "https://www.boschrexroth.com/de/de/myrexroth/collaboration/collaboration-rooms/?path=/Ctrlx-Automation/ctrlX_eShop/ctrlX%20CORE%20-%20OPC%20UA%20Apps"
      }
    ],
    "title": "Vulnerabilities in Rexroth IndraWorks",
    "tracking": {
      "current_release_date": "2026-11-10T00:00:00Z",
      "generator": {
        "date": "2026-11-10T12:36:28.493Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.19"
        }
      },
      "id": "BOSCH-SA-591522",
      "initial_release_date": "2026-02-13T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-02-13T00:00:00Z",
          "number": "1",
          "summary": "Initial publication (date normalized to midnight UTC)"
        },
        {
          "date": "2026-02-27T00:00:00Z",
          "number": "2",
          "summary": "Update as patch is available (date normalized to midnight UTC)"
        },
        {
          "date": "2026-11-10T00:00:00Z",
          "number": "3",
          "summary": "Added CVE-2026-102448 (date normalized to midnight UTC)"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "full_product_names": [
      {
        "name": "Rexroth IndraWorks before 15V24",
        "product_id": "CSAFPID-0001"
      },
      {
        "name": "Rexroth IndraWorks 15V24 and later",
        "product_id": "CSAFPID-0002"
      },
      {
        "name": "Rexroth OPC DA Client before 33.0.0.0",
        "product_id": "CSAFPID-0003"
      },
      {
        "name": "Rexroth OPC DA Client 33.0.0.0 and later",
        "product_id": "CSAFPID-0004"
      },
      {
        "name": "Rexroth UA.TestClient before 2.9.0",
        "product_id": "CSAFPID-0005"
      },
      {
        "name": "Rexroth UA.TestClient 2.9.0 and later",
        "product_id": "CSAFPID-0006"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-60035",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "notes": [
        {
          "category": "description",
          "text": "The OPC DA Client processes malicious serialized data from a manipulated file. Exploitation requires a user to open a specially crafted malicious file and can result in arbitrary code execution and compromise of the affected workstation.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0004"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Install OPC DA Client version 33.0.0.0 or later using the standalone package and replace the vulnerable utility in the IndraWorks installation folder. IndraWorks 15V24 ships with an unaffected OPC DA Client.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003"
          ],
          "url": "https://www.boschrexroth.com/de/de/media-details/2f969694-b755-407f-9d02-8f86aee0e98c"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2025-60035 in Rexroth IndraWorks ecosystem"
    },
    {
      "cve": "CVE-2025-60036",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "notes": [
        {
          "category": "description",
          "text": "The UA.TestClient processes malicious serialized data from a manipulated file. Exploitation requires a user to open a specially crafted malicious file and can result in arbitrary code execution and compromise of the affected workstation.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0006"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0005"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Install UA.TestClient version 2.9.0 or later using the standalone package and replace the vulnerable utility in the IndraWorks installation folder. UA.TestClient is removed from IndraWorks starting with 15V24.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0005"
          ],
          "url": "https://www.boschrexroth.com/de/de/myrexroth/collaboration/collaboration-rooms/?path=/Ctrlx-Automation/ctrlX_eShop/ctrlX%20CORE%20-%20OPC%20UA%20Apps"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0005"
          ]
        }
      ],
      "title": "CVE-2025-60036 in Rexroth IndraWorks ecosystem"
    },
    {
      "cve": "CVE-2025-60037",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "notes": [
        {
          "category": "description",
          "text": "Rexroth IndraWorks deserializes malicious data from a manipulated file. Exploitation requires a user to open a specially crafted malicious file and can result in arbitrary code execution and compromise of the affected workstation.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Only open and process files from trustworthy sources. Bosch states this vulnerability cannot be resolved due to backward compatibility and/or assessed exploitation risk.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Bosch states that this vulnerability cannot be resolved for backward-compatibility and/or risk reasons.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2025-60037 in Rexroth IndraWorks ecosystem"
    },
    {
      "cve": "CVE-2025-60038",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "notes": [
        {
          "category": "description",
          "text": "Rexroth IndraWorks deserializes malicious data from a manipulated file. Exploitation requires a user to open a specially crafted malicious file and can result in arbitrary code execution and compromise of the affected workstation.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Only open and process files from trustworthy sources. Bosch states this vulnerability cannot be resolved due to backward compatibility and/or assessed exploitation risk.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Bosch states that this vulnerability cannot be resolved for backward-compatibility and/or risk reasons.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2025-60038 in Rexroth IndraWorks ecosystem"
    },
    {
      "cve": "CVE-2026-102448",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory"
      },
      "notes": [
        {
          "category": "description",
          "text": "The IndraWorks file parser insufficiently sanitizes path names or references in a manipulated file, allowing traversal outside the intended directory and writes to unauthorized locations, potentially resulting in arbitrary code execution. User interaction is required to open the crafted file.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Only open and process files from trustworthy sources. Bosch states this vulnerability cannot be resolved due to backward compatibility and/or assessed exploitation risk.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Bosch states that this vulnerability cannot be resolved for backward-compatibility and/or risk reasons.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2026-102448 in Rexroth IndraWorks ecosystem"
    }
  ]
}