Deserialization in Bosch Rexroth Indraworks
CVE-2025-60036
A vulnerability has been identified in the UA.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are affected. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file containing malicious serialized data. Exploitation requires user interaction, specifically opening a specially crafted file, which then causes the application to deserialize the malicious data, enabling Remote Code Execution (RCE). This can lead to a complete compromise of the system running the UA.Testclient.
Vulnerability class: Insecure Deserialization
EPSS: 0.004 (29.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Bosch Rexroth_indraworks
- Bosch Rexroth_ua.testclient
- Bosch Rexroth Indraworks — versions 0
- Bosch Rexroth Ua.testclient — versions 0
Weakness classification (CWE)
References
- psirt@bosch.com (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-60036?
- CVE-2025-60036 is a high-severity vulnerability in Bosch Rexroth Indraworks, classified under Deserialization of Untrusted Data. CVSS score: 7.8/10. Published 2026-02-18.
- How severe is CVE-2025-60036?
- High severity. CVSS v3 base score is 7.8 out of 10.