Bosch Rexroth ctrlX OS Web Application Arbitrary HTML Injection Vulnerability

A vulnerability exists in the error notification messages of the ctrlX OS web application, allowing remote unauthenticated attackers to inject arbitrary HTML tags. This injection could potentially be used to execute client-side code in the context of another user's browser, via a crafted HTTP request.

Impact

Exploitation of this vulnerability could lead to cross-site scripting (XSS) attacks, allowing for the execution of arbitrary client-side scripts in the affected user's browser.

Remediation

Users are advised to update to the latest versions of the affected applications. The update may require a device reboot. To check if the updated versions are installed, use the device's package management system.