https://vulnogram.org/ Most recent CVEs assigned by Robert Bosch GmbH (bosch). https://vulnogram.org/seaview/icons/bosch.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-42808 https://vulnogram.org/CVE-2026-42808 An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11. The host streaming API function {{coines_read_stream_sensor_data()}} fails to validate the boundaries of the caller-provided destination buffer. Internally, the stream p… Medium Thu, 10 Sep 2026 09:05:36 GMT https://vulnogram.org/CVE-2026-42807 https://vulnogram.org/CVE-2026-42807 A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of BoschSensortec COINES_SDK (versions 2.10 through 2.12.2) allows attackers to cause a denial of service (process crash) or potentially execute arbitrary code. The bridge d… High Thu, 10 Sep 2026 09:05:10 GMT https://vulnogram.org/CVE-2026-42806 https://vulnogram.org/CVE-2026-42806 An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_all_field_data (bme69x.c). The driver prefetches heater configuration re… Medium Thu, 10 Sep 2026 09:04:44 GMT https://vulnogram.org/CVE-2026-42805 https://vulnogram.org/CVE-2026-42805 A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI (C library) within the debug message parser function bhi385_parse_debug_message (located in bhi385_parse.c). The function parses FIFO events and extracts an 8-… High Thu, 10 Sep 2026 09:04:09 GMT https://vulnogram.org/CVE-2026-42804 https://vulnogram.org/CVE-2026-42804 A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit d6b200416a. The vulnerability is located within the FIFO parsing and debug logging subsystem inside the funct… High Thu, 10 Sep 2026 08:56:14 GMT https://vulnogram.org/CVE-2026-56428 https://vulnogram.org/CVE-2026-56428 The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorized_keys file for t… High Network Exploitable Thu, 30 Jul 2026 13:11:11 GMT https://vulnogram.org/CVE-2024-58330 https://vulnogram.org/CVE-2024-58330 A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video analytics event data. High Network Exploitable Thu, 23 Jul 2026 07:56:34 GMT https://vulnogram.org/CVE-2024-58023 https://vulnogram.org/CVE-2024-58023 Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an attacker to access sensitive information. High Thu, 23 Jul 2026 07:52:32 GMT https://vulnogram.org/CVE-2024-33618 https://vulnogram.org/CVE-2024-33618 Uncontrolled Resource Consumption in Bosch VMS Central Server in Bosch VMS 12.0.1 allows attackers to consume excessive amounts of disk space via network interface. High Network Exploitable Wed, 15 Apr 2026 09:51:52 GMT https://vulnogram.org/CVE-2025-60038 https://vulnogram.org/CVE-2025-60038 A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file containing malicious serialized data. Exploitation requires user interaction, specifi… High Wed, 18 Feb 2026 14:03:49 GMT https://vulnogram.org/CVE-2025-60037 https://vulnogram.org/CVE-2025-60037 A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file containing malicious serialized data. Exploitation requires user interaction, specifi… High Wed, 18 Feb 2026 14:03:19 GMT https://vulnogram.org/CVE-2025-60036 https://vulnogram.org/CVE-2025-60036 A vulnerability has been identified in the UA.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are affected. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated… High Wed, 18 Feb 2026 14:02:37 GMT https://vulnogram.org/CVE-2025-60035 https://vulnogram.org/CVE-2025-60035 A vulnerability has been identified in the OPC.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are affected. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated… High Wed, 18 Feb 2026 14:01:59 GMT https://vulnogram.org/CVE-2025-48862 https://vulnogram.org/CVE-2025-48862 Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set. However, only the private key - if available in the backup - is encrypted, while the backu… High Thu, 14 Aug 2025 09:08:01 GMT https://vulnogram.org/CVE-2025-48861 https://vulnogram.org/CVE-2025-48861 A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to access and extract internal application data, including potential debug logs and the version of installed apps. Medium Network Exploitable Thu, 14 Aug 2025 09:07:24 GMT https://vulnogram.org/CVE-2025-48860 https://vulnogram.org/CVE-2025-48860 A vulnerability in the web application of the ctrlX OS setup mechanism facilitated an authenticated (low privileged) attacker to gain remote access to backup archives created by a user with elevated permissions. Depending on the content of the backup… High Thu, 14 Aug 2025 09:06:36 GMT https://vulnogram.org/CVE-2025-29902 https://vulnogram.org/CVE-2025-29902 Remote code execution that allows unauthorized users to execute arbitrary code on the server machine. Critical Network Exploitable Fri, 13 Jun 2025 09:23:49 GMT https://vulnogram.org/CVE-2025-27532 https://vulnogram.org/CVE-2025-27532 A vulnerability in the “Backup & Restore” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to access secret information via multiple crafted HTTP requests. Medium Wed, 30 Apr 2025 11:49:02 GMT https://vulnogram.org/CVE-2025-24351 https://vulnogram.org/CVE-2025-24351 A vulnerability in the “Remote Logging” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to execute arbitrary OS commands in the context of user “root” via a crafted HTTP request. High Wed, 30 Apr 2025 11:47:00 GMT https://vulnogram.org/CVE-2025-24350 https://vulnogram.org/CVE-2025-24350 A vulnerability in the “Certificates and Keys” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to write arbitrary certificates in arbitrary file system paths via a crafted HTTP request. High Wed, 30 Apr 2025 11:45:52 GMT https://vulnogram.org/CVE-2025-24349 https://vulnogram.org/CVE-2025-24349 A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to delete the configuration of physical network interfaces via a crafted HTTP request. High Wed, 30 Apr 2025 11:44:33 GMT https://vulnogram.org/CVE-2025-24348 https://vulnogram.org/CVE-2025-24348 A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the wireless network configuration file via a crafted HTTP request. Medium Wed, 30 Apr 2025 11:42:54 GMT https://vulnogram.org/CVE-2025-24347 https://vulnogram.org/CVE-2025-24347 A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the network configuration file via a crafted HTTP request. Medium Wed, 30 Apr 2025 11:41:39 GMT https://vulnogram.org/CVE-2025-24346 https://vulnogram.org/CVE-2025-24346 A vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to manipulate the “/etc/environment” file via a crafted HTTP request. High Wed, 30 Apr 2025 11:39:42 GMT https://vulnogram.org/CVE-2025-24345 https://vulnogram.org/CVE-2025-24345 A vulnerability in the “Hosts” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the “hosts” file in an unintended manner via a crafted HTTP request. Medium Wed, 30 Apr 2025 11:35:44 GMT https://vulnogram.org/CVE-2025-24344 https://vulnogram.org/CVE-2025-24344 A vulnerability in the error notification messages of the web application of ctrlX OS allows a remote unauthenticated attacker to inject arbitrary HTML tags and, possibly, execute arbitrary client-side code in the context of another user's browser vi… Medium Network Exploitable Wed, 30 Apr 2025 11:33:44 GMT https://vulnogram.org/CVE-2025-24343 https://vulnogram.org/CVE-2025-24343 A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to write arbitrary files in arbitrary file system paths via a crafted HTTP request. Medium Wed, 30 Apr 2025 11:26:51 GMT https://vulnogram.org/CVE-2025-24342 https://vulnogram.org/CVE-2025-24342 A vulnerability in the login functionality of the web application of ctrlX OS allows a remote unauthenticated attacker to guess valid usernames via multiple crafted HTTP requests. Medium Network Exploitable Wed, 30 Apr 2025 11:25:35 GMT https://vulnogram.org/CVE-2025-24341 https://vulnogram.org/CVE-2025-24341 A vulnerability in the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to induce a Denial-of-Service (DoS) condition on the device via multiple crafted HTTP requests. In the worst case, a full power cycle is needed… Medium Wed, 30 Apr 2025 11:14:47 GMT https://vulnogram.org/CVE-2025-24340 https://vulnogram.org/CVE-2025-24340 A vulnerability in the users configuration file of ctrlX OS may allow a remote authenticated (low-privileged) attacker to recover the plaintext passwords of other users. Medium Wed, 30 Apr 2025 10:59:06 GMT https://vulnogram.org/CVE-2025-24339 https://vulnogram.org/CVE-2025-24339 A vulnerability in the web application of ctrlX OS allows a remote unauthenticated attacker to conduct various attacks against users of the vulnerable system, including web cache poisoning or Man-in-the-Middle (MitM), via a crafted HTTP request. Medium Network Exploitable Wed, 30 Apr 2025 10:54:56 GMT https://vulnogram.org/CVE-2025-24338 https://vulnogram.org/CVE-2025-24338 A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to execute arbitrary client-side code in the context of another user's browser via multiple crafted HTTP… High Wed, 30 Apr 2025 10:51:00 GMT https://vulnogram.org/CVE-2024-48989 https://vulnogram.org/CVE-2024-48989 A vulnerability in the PROFINET stack implementation of the IndraDrive (all versions) of Bosch Rexroth allows an attacker to cause a denial of service, rendering the device unresponsive by sending arbitrary UDP messages. High Network Exploitable Wed, 13 Nov 2024 13:39:15 GMT https://vulnogram.org/CVE-2023-32228 https://vulnogram.org/CVE-2023-32228 A firmware bug which may lead to misinterpretation of data in the AMC2-4WCF and AMC2-2WCF allowing an adversary to grant access to the last authorized user. Medium Thu, 11 Apr 2024 09:05:08 GMT https://vulnogram.org/CVE-2024-25002 https://vulnogram.org/CVE-2024-25002 Command Injection in the diagnostics interface of the Bosch Network Synchronizer allows unauthorized users full access to the device. High Mon, 25 Mar 2024 13:55:15 GMT https://vulnogram.org/CVE-2023-48266 https://vulnogram.org/CVE-2023-48266 The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request. High Network Exploitable Wed, 10 Jan 2024 13:10:15 GMT https://vulnogram.org/CVE-2023-48265 https://vulnogram.org/CVE-2023-48265 The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request. High Network Exploitable Wed, 10 Jan 2024 13:09:46 GMT https://vulnogram.org/CVE-2023-48264 https://vulnogram.org/CVE-2023-48264 The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request. High Network Exploitable Wed, 10 Jan 2024 13:09:10 GMT https://vulnogram.org/CVE-2023-48263 https://vulnogram.org/CVE-2023-48263 The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request. High Network Exploitable Wed, 10 Jan 2024 13:08:37 GMT https://vulnogram.org/CVE-2023-48262 https://vulnogram.org/CVE-2023-48262 The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request. High Network Exploitable Wed, 10 Jan 2024 13:08:03 GMT https://vulnogram.org/CVE-2023-48261 https://vulnogram.org/CVE-2023-48261 The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request. Medium Network Exploitable Wed, 10 Jan 2024 13:07:22 GMT https://vulnogram.org/CVE-2023-48260 https://vulnogram.org/CVE-2023-48260 The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request. Medium Network Exploitable Wed, 10 Jan 2024 13:06:48 GMT https://vulnogram.org/CVE-2023-48259 https://vulnogram.org/CVE-2023-48259 The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request. Medium Network Exploitable Wed, 10 Jan 2024 13:05:41 GMT https://vulnogram.org/CVE-2023-48258 https://vulnogram.org/CVE-2023-48258 The vulnerability allows a remote attacker to delete arbitrary files on the file system via a crafted URL or HTTP request through a victim’s session. Medium Wed, 10 Jan 2024 13:05:08 GMT https://vulnogram.org/CVE-2023-48257 https://vulnogram.org/CVE-2023-48257 The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges on the device. The vulnerability can be exploited directly by authenticated users, via craft… High Wed, 10 Jan 2024 13:04:36 GMT https://vulnogram.org/CVE-2023-48256 https://vulnogram.org/CVE-2023-48256 The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s session via a crafted URL or HTTP request. Medium Wed, 10 Jan 2024 13:04:04 GMT https://vulnogram.org/CVE-2023-48255 https://vulnogram.org/CVE-2023-48255 The vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP request, or simply by waiting for t… Medium Network Exploitable Wed, 10 Jan 2024 13:03:32 GMT https://vulnogram.org/CVE-2023-48254 https://vulnogram.org/CVE-2023-48254 The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request. Medium Wed, 10 Jan 2024 13:02:51 GMT https://vulnogram.org/CVE-2023-48253 https://vulnogram.org/CVE-2023-48253 The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTTP request. By abusing this vulnerability it is possible to exfiltrate other users’ password hashes or update… High Wed, 10 Jan 2024 13:02:19 GMT https://vulnogram.org/CVE-2023-48252 https://vulnogram.org/CVE-2023-48252 The vulnerability allows an authenticated remote attacker to perform actions exceeding their authorized access via crafted HTTP requests. High Wed, 10 Jan 2024 13:01:35 GMT