Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-24318 State: PUBLISHED Published: 2025-02-28T17:09:05.687Z Last Updated: 2025-02-28T18:19:26.403Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Dario Health Products: Dario Application Database and Internet-based Server Infrastructure Problem Types: CWE-1004 Description: Cookie policy is observable via built-in browser tools. In the presence of XSS, this could lead to full session compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-058-01 - https://www.dariohealth.com/contact/
CVE ID: CVE-2025-24319 State: PUBLISHED Published: 2025-02-05T17:31:06.003Z Last Updated: 2025-02-12T19:41:06.452Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Next Central Manager Problem Types: CWE-20 Description: When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the BIG-IP Next Central Manager Node's Kubernetes service to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000148412
CVE ID: CVE-2025-24320 State: PUBLISHED Published: 2025-02-05T17:31:05.551Z Last Updated: 2025-02-06T14:04:35.185Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-79 Description: A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. This vulnerability is due to an incomplete fix for CVE-2024-31156 https://my.f5.com/manage/s/article/K000138636 . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP V
re versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000140578
CVE ID: CVE-2025-24322 State: PUBLISHED Published: 2025-08-20T13:09:08.741Z Last Updated: 2025-11-03T18:08:56.972Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Tenda Products: AC6 V5.0 Problem Types: CWE-304 Description: An unsafe default authentication vulnerability exists in the Initial Setup Authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted network request can lead to arbitrary code execution. An attacker can browse to the device to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2163
CVE ID: CVE-2025-24323 State: PUBLISHED Published: 2025-08-12T16:58:53.963Z Last Updated: 2025-08-15T03:55:43.860Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: firmware package and LED mode toggle tool for some Intel(R) PCIe Switch software Problem Types: Escalation of Privilege, CWE-284 Description: Improper access control in some firmware package and LED mode toggle tool for some Intel(R) PCIe Switch software before version MR4_1.0b1 may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/
s. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01339.html
CVE ID: CVE-2025-24324 State: PUBLISHED Published: 2025-08-12T16:58:55.702Z Last Updated: 2025-08-14T03:55:54.553Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: n/a Products: Intel(R) 800 Series Ethernet Problem Types: Escalation of Privilege, CWE-190 Description: Integer overflow or wraparound in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.17.2 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01296.html
CVE ID: CVE-2025-24325 State: PUBLISHED Published: 2025-08-12T16:58:57.250Z Last Updated: 2025-08-14T03:55:47.290Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) 800 Series Ethernet Problem Types: Escalation of Privilege, CWE-20 Description: Improper input validation in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.17.2 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01296.html
CVE ID: CVE-2025-24326 State: PUBLISHED Published: 2025-02-05T17:31:02.740Z Last Updated: 2025-02-05T18:16:56.908Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-787 Description: When BIG-IP Advanced WAF/ASM Behavioral DoS (BADoS) TLS Signatures feature is configured, undisclosed traffic can case an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000140950
CVE ID: CVE-2025-24327 State: PUBLISHED Published: 2025-11-11T16:49:45.543Z Last Updated: 2025-11-14T04:55:39.862Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Rapid Storage Technology Application Problem Types: Escalation of Privilege, CWE-277 Description: Insecure inherited permissions for some Intel(R) Rapid Storage Technology Application before version 20.0.1021 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requir
complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01362.html
CVE ID: CVE-2025-24328 State: PUBLISHED Published: 2025-07-02T07:39:30.318Z Last Updated: 2025-07-02T13:45:17.927Z Vendors: Nokia Products: Nokia Single RAN Description: Sending a crafted SOAP "set" operation message within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network can cause Nokia Single RAN baseband OAM service component restart with software versions earlier than release 24R1-SR 1.0 MP. This issue has been corrected to release 24R1-SR 1.0 MP and later. The OAM service component restarts automatically after the stack overflow without causing a base station restart or network service degradation, and without leaving any permanent impact on the N
without causing a base station restart or network service degradation, and without leaving any permanent impact on the Nokia Single RAN baseband OAM service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24328/
CVE ID: CVE-2025-24329 State: PUBLISHED Published: 2025-07-02T08:27:43.287Z Last Updated: 2025-07-02T13:38:28.621Z Vendors: Nokia Products: Nokia Single RAN Description: Sending a crafted SOAP "provision" operation message archive field within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network can cause path traversal issue in Nokia Single RAN baseband software with versions earlier than release 24R1-SR 1.0 MP. This issue has been corrected to release 24R1-SR 1.0 MP and later. Beginning with release 24R1-SR 1.0 MP, the OAM service software utilizes libarchive APIs with security options enabled, effectively mitigating the reported path traversal issue. Ad
are utilizes libarchive APIs with security options enabled, effectively mitigating the reported path traversal issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24329/
CVE ID: CVE-2025-24330 State: PUBLISHED Published: 2025-07-02T08:29:03.339Z Last Updated: 2025-07-02T14:39:50.109Z Vendors: Nokia Products: Nokia Single RAN Description: Sending a crafted SOAP "provision" operation message PlanId field within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network can cause path traversal issue in Nokia Single RAN baseband software with versions earlier than release 24R1-SR 1.0 MP. This issue has been corrected to release 24R1-SR 1.0 MP and later. Beginning with release 24R1-SR 1.0 MP, the OAM service software performed PlanId field input validations mitigate the reported path traversal issue. Additional Analyst Notes: - CISA
re performed PlanId field input validations mitigate the reported path traversal issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24330/
CVE ID: CVE-2025-24331 State: PUBLISHED Published: 2025-07-02T08:30:19.565Z Last Updated: 2025-07-02T14:36:32.449Z Vendors: Nokia Products: Nokia Single RAN Description: The Single RAN baseband OAM service is intended to run as an unprivileged service. However, it initially starts with root privileges and assigns certain capabilities before dropping to an unprivileged level. The capabilities retained from the root period are considered extensive after the privilege drop and, in theory, could potentially allow actions beyond the intended scope of the OAM service. These actions could include gaining root privileges, accessing root-owned files, modifying them as the file owner, and then returni
ns could include gaining root privileges, accessing root-owned files, modifying them as the file owner, and then returning them to root ownership. This issue has been corrected starting from release 24R1-SR 0.2 MP and later. Beginning with release 24R1-SR 0.2 MP, the OAM service software capabilities are restricted to the minimum necessary. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24331/
CVE ID: CVE-2025-24332 State: PUBLISHED Published: 2025-07-02T08:31:38.820Z Last Updated: 2025-07-02T14:26:54.520Z Vendors: Nokia Products: Nokia Single RAN AirScale (Flexi Multiradio is not affected) Description: Nokia Single RAN AirScale baseband allows an authenticated administrative user access to all physical boards after performing a single login to the baseband system board. The baseband does not re-authenticate the user when they connect from the baseband system board to the baseband capacity boards using the internal bsoc SSH service, which is available only internally within the baseband and through the internal backplane between the boards. The bsoc SSH allows login from one board
ally within the baseband and through the internal backplane between the boards. The bsoc SSH allows login from one board to another via the baseband internal backplane using an SSH private key present on the baseband system board. This bsoc SSH capability was previously considered an administrative functionality but has now been restricted to be available only to baseband root-privileged administrators. This restriction mitigates the possibility of misuse with lower-level privileges (e.g., from baseband software images). This mitigation is included starting from release 23R4-SR 3.0 MP and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nokia.com/about-us/se
4-SR 3.0 MP and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24332/
CVE ID: CVE-2025-24333 State: PUBLISHED Published: 2025-07-02T08:32:57.271Z Last Updated: 2025-07-02T14:13:31.539Z Vendors: Nokia Products: Nokia Single RAN Description: Nokia Single RAN baseband software earlier than 24R1-SR 1.0 MP contains administrative shell input validation fault, which authenticated admin user can, in theory, potentially use for injecting arbitrary commands for unprivileged baseband OAM service process execution via special characters added to baseband internal COMA_config.xml file. This issue has been corrected starting from release 24R1-SR 1.0 MP and later, by adding proper input validation to OAM service process which prevents injecting special characters via baseba
d later, by adding proper input validation to OAM service process which prevents injecting special characters via baseband internal COMA_config.xml file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24333/
CVE ID: CVE-2025-24334 State: PUBLISHED Published: 2025-07-02T08:34:12.062Z Last Updated: 2025-07-02T14:11:07.140Z Vendors: Nokia Products: Nokia Single RAN Description: The Nokia Single RAN baseband software earlier than 23R2-SR 1.0 MP can be made to reveal the exact software release version by sending a specific HTTP POST request through the Mobile Network Operator (MNO) internal RAN management network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24334/
CVE ID: CVE-2025-24335 State: PUBLISHED Published: 2025-07-02T08:35:46.346Z Last Updated: 2025-07-02T13:26:40.283Z Vendors: Nokia Products: Nokia Single RAN Description: Nokia Single RAN baseband software versions earlier than 24R1-SR 2.1 MP contain a SOAP message input validation flaw, which in theory could potentially be used for causing resource exhaustion in the Single RAN baseband OAM service. No practical exploit has been detected for this flaw. However, the issue has been corrected starting from release 24R1-SR 2.1 MP by adding sufficient input validation for received SOAP requests, effectively mitigating the reported issue. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
d SOAP requests, effectively mitigating the reported issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24335/
CVE ID: CVE-2025-24336 State: PUBLISHED Published: 2025-01-31T00:02:56.347Z Last Updated: 2025-01-31T17:43:46.505Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: General Incorporated Association OCF Products: SXF Common Library Problem Types: CWE-237 Description: SXF Common Library handles input data improperly. If a product using the library reads a crafted file, the product may be crashed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ocf.or.jp/about/download/sxflibrary - https://jvn.jp/en/jp/JVN23839833/
CVE ID: CVE-2025-24337 State: PUBLISHED Published: 2025-01-20T00:00:00 Last Updated: 2025-01-21T20:25:39.697Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Musing Studio Products: WriteFreely Problem Types: CWE-281 Description: WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raphus.social/@TV4Fun/113846757112643161 - https://github.com/writefreely/writefreely/releases/tag/v0.15.1 - https://www.openwall.com/lists/oss-security/2025/01/18/1
CVE ID: CVE-2025-24338 State: PUBLISHED Published: 2025-04-30T10:51:00.663Z Last Updated: 2025-08-27T20:43:01.061Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Bosch Rexroth AG Products: ctrlX OS - Solutions Problem Types: CWE-116 Description: A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to execute arbitrary client-side code in the context of another user's browser via multiple crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-640452.html
CVE ID: CVE-2025-24339 State: PUBLISHED Published: 2025-04-30T10:54:56.607Z Last Updated: 2025-04-30T15:46:30.151Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Bosch Rexroth AG Products: ctrlX OS - Device Admin Problem Types: CWE-644 Description: A vulnerability in the web application of ctrlX OS allows a remote unauthenticated attacker to conduct various attacks against users of the vulnerable system, including web cache poisoning or Man-in-the-Middle (MitM), via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-640452.html
CVE ID: CVE-2025-24340 State: PUBLISHED Published: 2025-04-30T10:59:06.633Z Last Updated: 2025-04-30T15:44:38.122Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Bosch Rexroth AG Products: ctrlX OS - Device Admin Problem Types: CWE-916 Description: A vulnerability in the users configuration file of ctrlX OS may allow a remote authenticated (low-privileged) attacker to recover the plaintext passwords of other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-640452.html
CVE ID: CVE-2025-24341 State: PUBLISHED Published: 2025-04-30T11:14:47.046Z Last Updated: 2025-04-30T15:11:57.073Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Bosch Rexroth AG Products: ctrlX OS - Device Admin Problem Types: CWE-770 Description: A vulnerability in the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to induce a Denial-of-Service (DoS) condition on the device via multiple crafted HTTP requests. In the worst case, a full power cycle is needed to regain control of the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-640452.html
CVE ID: CVE-2025-24342 State: PUBLISHED Published: 2025-04-30T11:25:35.615Z Last Updated: 2025-04-30T15:08:39.394Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Bosch Rexroth AG Products: ctrlX OS - Device Admin Problem Types: CWE-204 Description: A vulnerability in the login functionality of the web application of ctrlX OS allows a remote unauthenticated attacker to guess valid usernames via multiple crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-640452.html
CVE ID: CVE-2025-24343 State: PUBLISHED Published: 2025-04-30T11:26:51.681Z Last Updated: 2025-04-30T15:07:05.596Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Bosch Rexroth AG Products: ctrlX OS - Solutions Problem Types: CWE-23 Description: A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to write arbitrary files in arbitrary file system paths via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-640452.html
CVE ID: CVE-2025-24344 State: PUBLISHED Published: 2025-04-30T11:33:44.949Z Last Updated: 2025-04-30T14:52:12.142Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Bosch Rexroth AG Products: ctrlX OS - Solutions Problem Types: CWE-81 Description: A vulnerability in the error notification messages of the web application of ctrlX OS allows a remote unauthenticated attacker to inject arbitrary HTML tags and, possibly, execute arbitrary client-side code in the context of another user's browser via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-640452.html
CVE ID: CVE-2025-24345 State: PUBLISHED Published: 2025-04-30T11:35:44.628Z Last Updated: 2025-04-30T14:44:15.824Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Bosch Rexroth AG Products: ctrlX OS - Device Admin Problem Types: CWE-1286 Description: A vulnerability in the “Hosts” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the “hosts” file in an unintended manner via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-640452.html
CVE ID: CVE-2025-24346 State: PUBLISHED Published: 2025-04-30T11:39:42.899Z Last Updated: 2025-08-27T20:43:01.207Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Bosch Rexroth AG Products: ctrlX OS - Device Admin Problem Types: CWE-1286 Description: A vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to manipulate the “/etc/environment” file via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-640452.html
CVE ID: CVE-2025-24347 State: PUBLISHED Published: 2025-04-30T11:41:39.707Z Last Updated: 2025-04-30T14:35:23.354Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Bosch Rexroth AG Products: ctrlX OS - Device Admin Problem Types: CWE-1286 Description: A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the network configuration file via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-640452.html
CVE ID: CVE-2025-24348 State: PUBLISHED Published: 2025-04-30T11:42:54.314Z Last Updated: 2025-04-30T14:34:17.218Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Bosch Rexroth AG Products: ctrlX OS - Device Admin Problem Types: CWE-1286 Description: A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the wireless network configuration file via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-640452.html
CVE ID: CVE-2025-24349 State: PUBLISHED Published: 2025-04-30T11:44:33.547Z Last Updated: 2025-04-30T14:30:33.942Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Bosch Rexroth AG Products: ctrlX OS - Device Admin Problem Types: CWE-183 Description: A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to delete the configuration of physical network interfaces via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-640452.html