CVE-2025-60035
Deserialization RCE in Rexroth IndraWorks OPC.Testclient
Publication date: 2026-02-18
Last updated on: 2026-02-24
Assigner: Robert Bosch GmbH
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bosch | rexroth_indraworks | to 15v24 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2025-60035 is a high-severity vulnerability in the OPC.Testclient utility included in Bosch Rexroth IndraWorks versions prior to 15V24.'}, {'type': 'paragraph', 'content': "The flaw allows an attacker to execute arbitrary code on the user's system by tricking the user into opening a specially crafted file containing malicious serialized data."}, {'type': 'paragraph', 'content': 'When the application parses this manipulated file, it deserializes the malicious data, enabling remote code execution (RCE) which can lead to full system compromise.'}] [1]
How can this vulnerability impact me? :
This vulnerability can have severe impacts including complete compromise of the system running the OPC.Testclient utility.
An attacker can execute arbitrary code remotely by convincing a user to open a malicious file, potentially leading to unauthorized access, data theft, or disruption of system operations.
The vulnerability affects confidentiality, integrity, and availability of the affected system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2025-60035 vulnerability, users should update the OPC.Testclient utility to IndraWorks version 15V24 or later once it becomes available.
Until the update is available, the only effective mitigation is to avoid opening files from untrusted sources, as exploitation requires user interaction by opening a specially crafted malicious file.