CVE-2023-48243 is a high severity (CVSS 8.1) vulnerability in the Bosch Rexroth Nexo cordless nutrunner, a path traversal flaw that allows arbitrary file upload. It affects NEXO-OS from V1000-Release to V1500-SP2. Install Nexo firmware V1.500 SP3, and keep the devices on protected network segments.
What's affected
Bosch PSIRT advisory BOSCH-SA-711465, published on 8 January 2024 and updated on 29 January 2024, covers 25 CVEs in the Nexo cordless nutrunner, a battery powered industrial tightening tool. The affected firmware is NEXO-OS V1000-Release up to and including NEXO-OS V1500-SP2. The advisory lists many models, including NXA011S-36V, NXA015S-36V, NXA030S-36V, NXA050S-36V, NXA065S-36V, NXP012QD-36V and NXV012T-36V, with their battery variants and several special versions.
This entry is a path traversal flaw that allows arbitrary file upload. The weakness is CWE-22 (Path Traversal). The record says a remote attacker can upload arbitrary files to any path on the system, running as the application OS user, which is root. Bosch adds that abusing it can lead to remote code execution with root privileges. The advisory scores it 8.1 and the record vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H shows that a low privilege account is needed.
Bosch lists the fix as Nexo Firmware V1.500 Service Pack 3, available through the myRexroth platform or your sales partner. Bosch scores this CVE the same as the record, so there is no severity conflict. The record does not mark the CVE as exploited in the wild, and the advisory does not say so. Bosch credits the discovery to Andrea Palanca of Nozomi Networks.
How to check if you're exposed
These are industrial devices, so there is no package manager to query. Use the device and your asset records.
- List every Nexo cordless nutrunner you own, by model and by serial number, including spares and ones in storage.
- Read the NEXO-OS firmware version for each from the device software or from your Bosch Rexroth support contact. Anything from V1000-Release to V1500-SP2 is affected. Service Pack 3 and later is the update Bosch names.
- Record which network segment each device sits in, and who can reach its web interface and SSH port from that segment.
If you cannot read the version quickly, assume the device is affected until Bosch or your sales partner confirms the firmware.
What to do now
- Obtain Nexo Firmware V1.500 Service Pack 3 from myRexroth or your sales partner and install it on every affected unit.
- Operate the nutrunners in protected network segments only, as the advisory strongly advises.
- Block access to the device web interface and SSH port from general office and guest networks.
- Review who holds accounts on the devices and change any passwords you set yourself.
- Record the firmware version of each unit in your asset register, and check the other CVEs listed in BOSCH-SA-711465.
Why it matters
Letting a user choose where an uploaded file lands is dangerous when the process runs as root. A file placed in a startup or script folder can become code. The weakness is a missing check that keeps the destination inside an intended directory. Because the web service runs as root, there is no second layer to limit the damage.
Operational technology often lives for years without updates, and the people who buy the tools are not the people who patch servers. Put the devices in the same inventory as your software, and give each firmware version an owner. See the Safeguard Gold page for this CVE for the record details, and the Gold directory for the other CVEs in this advisory.
Quick check
Which firmware fixes CVE-2023-48243?
Bosch lists Nexo Firmware V1.500 Service Pack 3 as the fix for this CVE.
What is the main mitigation Bosch gives?
Operate affected Nexo nutrunners in protected network segments only, and apply risk mitigating measures that fit your environment.
Sources
Last reviewed: 19 October 2026.
