CVE-2023-48258 is a medium severity (CVSS 5.5) vulnerability in the Bosch Rexroth Nexo cordless nutrunner, a cross-site request forgery flaw that can delete files. It affects NEXO-OS from V1000-Release to V1500-SP2. Bosch lists no fix for this one, so protect the device and segment the network.
What's affected
Bosch PSIRT advisory BOSCH-SA-711465, published on 8 January 2024 and updated on 29 January 2024, covers 25 CVEs in the Nexo cordless nutrunner, a battery powered industrial tightening tool. The affected firmware is NEXO-OS V1000-Release up to and including NEXO-OS V1500-SP2. The advisory lists many models, including NXA011S-36V, NXA015S-36V, NXA030S-36V, NXA050S-36V, NXA065S-36V, NXP012QD-36V and NXV012T-36V, with their battery variants and several special versions.
This entry is a cross-site request forgery flaw that can delete files. The weakness is CWE-352 (Cross-Site Request Forgery). The record says a remote attacker can delete arbitrary files on the file system through a crafted URL or HTTP request made through a victim's session. It scores it 5.5 with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, so a user has to be tricked into triggering it and the impact is on availability.
Bosch does not list this CVE among the ones fixed in Service Pack 3, so the advisory gives no patched version for it. Bosch scores this CVE the same as the record, so there is no severity conflict. The record does not mark the CVE as exploited in the wild, and the advisory does not say so. Bosch credits the discovery to Andrea Palanca of Nozomi Networks.
How to check if you're exposed
These are industrial devices, so there is no package manager to query. Use the device and your asset records.
- List every Nexo cordless nutrunner you own, by model and by serial number, including spares and ones in storage.
- Read the NEXO-OS firmware version for each from the device software or from your Bosch Rexroth support contact. Anything from V1000-Release to V1500-SP2 is affected. Service Pack 3 and later is the update Bosch names.
- Record which network segment each device sits in, and who can reach its web interface and SSH port from that segment.
If you cannot read the version quickly, assume the device is affected until Bosch or your sales partner confirms the firmware.
What to do now
- Operate the nutrunners in protected network segments only, as the advisory strongly advises.
- Limit browser access to the device interface to a dedicated administration workstation, and sign out after use.
- Install Nexo Firmware V1.500 SP3 anyway, since it fixes 16 other CVEs from the same advisory.
- Ask Bosch or your sales partner whether a later release addresses this CVE.
- Record the firmware version of each unit in your asset register.
Why it matters
Cross-site request forgery works because the browser attaches the user's session to requests the user did not intend to make. A person signed in to the device web interface who visits a hostile page could trigger a file deletion. Using a separate browser profile or workstation for device administration, and signing out when done, reduces the chance.
Operational technology often lives for years without updates, and the people who buy the tools are not the people who patch servers. Put the devices in the same inventory as your software, and give each firmware version an owner. See the Safeguard Gold page for this CVE for the record details, and the Gold directory for the other CVEs in this advisory.
Quick check
Which firmware fixes CVE-2023-48258?
Bosch lists none for this CVE. Service Pack 3 fixes 16 other CVEs in the same advisory, so install it and protect the device.
What is the main mitigation Bosch gives?
Operate affected Nexo nutrunners in protected network segments only, and apply risk mitigating measures that fit your environment.
Sources
Last reviewed: 19 October 2026.
