CVE-2023-48245 is a medium severity (CVSS 6.5) vulnerability in the Bosch Rexroth Nexo cordless nutrunner, a missing authorization flaw that allows unauthenticated file upload. It affects NEXO-OS from V1000-Release to V1500-SP2. Install Nexo firmware V1.500 SP3, and keep the devices on protected network segments.
What's affected
Bosch PSIRT advisory BOSCH-SA-711465, published on 8 January 2024 and updated on 29 January 2024, covers 25 CVEs in the Nexo cordless nutrunner, a battery powered industrial tightening tool. The affected firmware is NEXO-OS V1000-Release up to and including NEXO-OS V1500-SP2. The advisory lists many models, including NXA011S-36V, NXA015S-36V, NXA030S-36V, NXA050S-36V, NXA065S-36V, NXP012QD-36V and NXV012T-36V, with their battery variants and several special versions.
This entry is a missing authorization flaw that allows unauthenticated file upload. The weakness is CWE-862 (Missing Authorization). The record says an unauthenticated remote attacker can upload arbitrary files, running as the application OS user (root), through a crafted HTTP request. It scores it 6.5 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, which needs no account and no user action.
Bosch lists the fix as Nexo Firmware V1.500 Service Pack 3, available through the myRexroth platform or your sales partner. Bosch scores this CVE the same as the record, so there is no severity conflict. The record does not mark the CVE as exploited in the wild, and the advisory does not say so. Bosch credits the discovery to Andrea Palanca of Nozomi Networks.
How to check if you're exposed
These are industrial devices, so there is no package manager to query. Use the device and your asset records.
- List every Nexo cordless nutrunner you own, by model and by serial number, including spares and ones in storage.
- Read the NEXO-OS firmware version for each from the device software or from your Bosch Rexroth support contact. Anything from V1000-Release to V1500-SP2 is affected. Service Pack 3 and later is the update Bosch names.
- Record which network segment each device sits in, and who can reach its web interface and SSH port from that segment.
If you cannot read the version quickly, assume the device is affected until Bosch or your sales partner confirms the firmware.
What to do now
- Obtain Nexo Firmware V1.500 Service Pack 3 from myRexroth or your sales partner and install it on every affected unit.
- Operate the nutrunners in protected network segments only, as the advisory strongly advises.
- Block access to the device web interface and SSH port from general office and guest networks.
- Review who holds accounts on the devices and change any passwords you set yourself.
- Record the firmware version of each unit in your asset register, and check the other CVEs listed in BOSCH-SA-711465.
Why it matters
Missing authorization means the endpoint does not check who is calling. The score is medium only because the record rates the impact on integrity and availability as low, but the same weakness class appears in the neighbouring entries for this device, and they can combine. An upload with no login is a useful first step for any attacker who already has network access.
Operational technology often lives for years without updates, and the people who buy the tools are not the people who patch servers. Put the devices in the same inventory as your software, and give each firmware version an owner. See the Safeguard Gold page for this CVE for the record details, and the Gold directory for the other CVEs in this advisory.
Quick check
Which firmware fixes CVE-2023-48245?
Bosch lists Nexo Firmware V1.500 Service Pack 3 as the fix for this CVE.
What is the main mitigation Bosch gives?
Operate affected Nexo nutrunners in protected network segments only, and apply risk mitigating measures that fit your environment.
Sources
Last reviewed: 19 October 2026.
