CVE-2023-48257 is a high severity (CVSS 7.8) vulnerability in the Bosch Rexroth Nexo cordless nutrunner, a weak credentials flaw in exported and imported packages. It affects NEXO-OS from V1000-Release to V1500-SP2. Bosch lists no fix for this one, so protect the device and segment the network.
What's affected
Bosch PSIRT advisory BOSCH-SA-711465, published on 8 January 2024 and updated on 29 January 2024, covers 25 CVEs in the Nexo cordless nutrunner, a battery powered industrial tightening tool. The affected firmware is NEXO-OS V1000-Release up to and including NEXO-OS V1500-SP2. The advisory lists many models, including NXA011S-36V, NXA015S-36V, NXA030S-36V, NXA050S-36V, NXA065S-36V, NXP012QD-36V and NXV012T-36V, with their battery variants and several special versions.
This entry is a weak credentials flaw in exported and imported packages. The weakness is CWE-1391 (Use of Weak Credentials) and CWE-287 (Improper Authentication). The record says a remote attacker can access sensitive data inside exported packages, or obtain remote code execution with root privileges. It can be exploited directly by authenticated users through crafted HTTP requests, or indirectly by unauthenticated users who reach already exported backup packages, or who craft an import package and induce an authenticated victim to upload it. The record scores it 7.8 with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The record lists two weakness classes, while the Bosch advisory lists only CWE-1391.
Bosch does not list this CVE among the ones fixed in Service Pack 3, so the advisory gives no patched version for it. Bosch scores this CVE the same as the record, so there is no severity conflict. The record does not mark the CVE as exploited in the wild, and the advisory does not say so. Bosch credits the discovery to Andrea Palanca of Nozomi Networks.
The advisory also says that fixing this CVE would make files that were already exported incompatible, which is why Bosch asks users to protect file storage instead.
How to check if you're exposed
These are industrial devices, so there is no package manager to query. Use the device and your asset records.
- List every Nexo cordless nutrunner you own, by model and by serial number, including spares and ones in storage.
- Read the NEXO-OS firmware version for each from the device software or from your Bosch Rexroth support contact. Anything from V1000-Release to V1500-SP2 is affected. Service Pack 3 and later is the update Bosch names.
- Record which network segment each device sits in, and who can reach its web interface and SSH port from that segment.
If you cannot read the version quickly, assume the device is affected until Bosch or your sales partner confirms the firmware.
What to do now
- Operate the nutrunners in protected network segments only, as the advisory strongly advises.
- Protect storage that holds exported packages and backups, and limit who can read or write it.
- Install Nexo Firmware V1.500 SP3 anyway, since it fixes 16 other CVEs from the same advisory.
- Ask Bosch or your sales partner whether a later release addresses this CVE.
- Record the firmware version of each unit in your asset register.
Why it matters
Exported backup packages are protected by credentials that an attacker can work out, so anyone who gets hold of a package can read it, and anyone who can get a victim to import a forged package can plant code. This is why the advisory puts the weight on storage: exported files must be kept where only trusted people can reach them.
Operational technology often lives for years without updates, and the people who buy the tools are not the people who patch servers. Put the devices in the same inventory as your software, and give each firmware version an owner. See the Safeguard Gold page for this CVE for the record details, and the Gold directory for the other CVEs in this advisory.
Quick check
Which firmware fixes CVE-2023-48257?
Bosch lists none for this CVE. Service Pack 3 fixes 16 other CVEs in the same advisory, so install it and protect the device.
What is the main mitigation Bosch gives?
Operate affected Nexo nutrunners in protected network segments only, and apply risk mitigating measures that fit your environment.
Sources
Last reviewed: 19 October 2026.
