CVE-2025-48862
7.1
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Exploitability: 2.5 / Impact: 4.0
Source: psirt@bosch.com (Secondary)
Description
Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set. However, only the private key - if available in the backup - is encrypted, while the backup file itself remains unencrypted.
Related CWEs
CWE-1104
Use of Unmaintained Third Party Components
The product relies on third-party components that are not
actively supported or maintained by the original developer or a trusted proxy
for the original developer.
CWE-311
Missing Encryption of Sensitive Data
The product does not encrypt sensitive or critical information before storage or transmission.
References (1)
Source: psirt@bosch.com
Timeline
No history available yet.