Bosch ctrlX OS Remote Command Execution Vulnerability in Remote Logging Functionality

A vulnerability exists in the remote logging feature of the Bosch ctrlX OS web application. This issue allows a remote authenticated (low-privileged) attacker to execute arbitrary operating system commands as the root user, by sending a crafted HTTP request. The vulnerability arises from improper handling of input, enabling command injection.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the operating system, with the commands being executed in the context of the root user.

Remediation

Users are advised to update to the latest versions of the affected ctrlX OS applications. The update process may require a device reboot. To check if the updated versions are installed, use the device's package management system.