Skip to main

Vulnerabilities in Rexroth IndraWorks

BOSCH-SA-591522

Advisory Information

Summary

Trend Micro has identified multiple vulnerabilities in Rexroth IndraWorks which affect both, IndraWorks and utilities that are shipped as part of the package. In a worst case scenario, a successful attack leads to a remote code execution.

Affected Products

  • Rexroth IndraWorks
    • CVE-2025-60035, CVE-2025-60036
      • Version(s): < 15V24
    • CVE-2025-60037, CVE-2025-60038, CVE-2026-102448
      • Version(s): all
  • Rexroth OPC DA Client
    • CVE-2025-60035
      • Version(s): < v33.0.0.0
  • Rexroth UA.TestClient
    • CVE-2025-60036
      • Version(s): < 2.9.0

Solution and Mitigations

Solution

A bugfix for CVE-2025-60035 (OPC DA Client) has been made available in the downloads area of Bosch Rexroth [1]. A bugfix for CVE-2025-60036 (UA.TestClient) has been made available in the Collaboration Rooms of Bosch Rexroth [2].

Users of each application are strongly advised to download the standalone package and to replace the vulnerable version in the IndraWorks installation folder.

IndraWorks 15V24 will be shipped with an OPC DA Client version that is not affected by the vulnerability. Please note that starting with IndraWorks 15V24, UA.TestClient has been removed from the package entirely.

Compensatory Measures

To maintain backwards compatibility with prior versions of IndraWorks and/or because the risk of a successful exploitation is considered low, CVE-2025-60037, CVE-2025-60038 and CVE-2026-102448 cannot be resolved. To be affected by those vulnerabilities, a user must import a file that has been manipulated by an attacker. Therefore, users of IndraWorks are advised to only open and process files from trustworthy sources.

Vulnerability Details

CVE-2025-60035

CVE Description: A vulnerability has been identified in the OPC DA Client utility, which is included in Rexroth IndraWorks and available as a separate download. All versions prior to v33.0.0.0 and included in IndraWorks prior to 15V24 are affected. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file containing malicious serialized data. Exploitation requires user interaction, specifically opening a specially crafted file, which then causes the application to deserialize the malicious data, enabling Remote Code Execution (RCE). This can lead to a complete compromise of the system running the OPC DA Client.

CVE-2025-60036

CVE Description: A vulnerability has been identified in the UA.TestClient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are affected. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file containing malicious serialized data. Exploitation requires user interaction, specifically opening a specially crafted file, which then causes the application to deserialize the malicious data, enabling Remote Code Execution (RCE). This can lead to a complete compromise of the system running the UA.TestClient.

CVE-2025-60037

CVE Description: A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file containing malicious serialized data. Exploitation requires user interaction, specifically opening a specially crafted file, which then causes the application to deserialize the malicious data, enabling Remote Code Execution (RCE). This can lead to a complete compromise of the system running Rexroth IndraWorks.

CVE-2025-60038

CVE Description: A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file containing malicious serialized data. Exploitation requires user interaction, specifically opening a specially crafted file, which then causes the application to deserialize the malicious data, enabling Remote Code Execution (RCE). This can lead to a complete compromise of the system running Rexroth IndraWorks.

CVE-2026-102448

CVE Description: A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user’s system by parsing a manipulated file, because the file parser fails to properly sanitize the path name(s) or references embedded in the manipulated file. Exploitation requires user interaction, specifically opening a specially crafted file, which then causes the application to traverse outside the target directory and to write files in unauthorized locations, eventually enabling Remote Code Execution (RCE). This can lead to a complete compromise of the system running Rexroth IndraWorks.

Remarks

Acknowledgement

The vulnerabilities have been uncovered and disclosed responsibly by Trend Micro. We thank them for making a responsible disclosure with us.

CVSS Scoring

Vulnerability classification has been performed using the CVSS v3.1 scoring system. The CVSS environmental score is specific to each customer's environment and should be defined by the customer to attain a final scoring.

Additional Resources

Revision History

  • 10 Nov 2026: Add CVE-2026-102448 for Rexroth IndraWorks
  • 27 Feb 2026: Update as patch is available
  • 13 Feb 2026: Initial Publication