CVE-2025-60037
Published: 18 February 2026
Description
A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file containing malicious serialized data. Exploitation requires user interaction, specifically opening a specially crafted file,…
more
which then causes the application to deserialize the malicious data, enabling Remote Code Execution (RCE). This can lead to a complete compromise of the system running Rexroth IndraWorks.
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the deserialization vulnerability in Rexroth IndraWorks by applying vendor patches to prevent RCE from malicious serialized files.
Requires validation of file inputs containing serialized data to block malicious payloads before deserialization occurs.
Implements memory protections like ASLR and DEP to mitigate arbitrary code execution even if deserialization succeeds.
Security SummaryAI
CVE-2025-60037 is a deserialization vulnerability (CWE-502) affecting Rexroth IndraWorks engineering software. The flaw allows an attacker to execute arbitrary code on the user's system by crafting a file with malicious serialized data. When a user opens this specially crafted file, the application deserializes the data, triggering remote code execution (RCE) and potentially leading to full system compromise. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Exploitation requires local access (AV:L) with low complexity (AC:L) and no privileges (PR:N), but depends on user interaction (UI:R), such as convincing the user to open the malicious file. An attacker can achieve high-impact effects on confidentiality, integrity, and availability (C:H/I:H/A:H) without changing scope (S:U), enabling complete compromise of the system hosting Rexroth IndraWorks.
Mitigation details are available in the Bosch PSIRT security advisory at https://psirt.bosch.com/security-advisories/BOSCH-SA-591522.html.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a deserialization flaw in client engineering software exploited via a malicious file opened by the user, directly enabling Exploitation for Client Execution (T1203) and User Execution via Malicious File (T1204.002).