CVE Feed

    Dashboard / CVE / CVE-2023-48257

    CVE-2023-48257

    The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges on the device. The vulnerability can be exploited directly by authenticated users, via crafted HTTP requests, or indirectly by unauthenticated users, by accessing already-exported backup packages, or crafting an import package and inducing an authenticated victim into sending the HTTP upload request.

    Published:Jan 10, 2024
    Last Modified:Jun 17, 2025
    EPS:Jan 10, 2024
    EPSS Score:0.00638
    CVSS Score:7.8

    Affected Products

    Vendor
    Bosch
    Product
    Nexo-os
    Vendor
    Bosch
    Product
    Nexo Cordless Nutrunner Nxa011s-36v-b \(0608842012\)
    Vendor
    Bosch
    Product
    Nexo Cordless Nutrunner Nxa011s-36v \(0608842011\)
    Vendor
    Bosch
    Product
    Nexo Cordless Nutrunner Nxa015s-36v-b \(0608842006\)
    Vendor
    Bosch
    Product
    Nexo Cordless Nutrunner Nxa015s-36v \(0608842001\)
    Vendor
    Bosch
    Product
    Nexo Cordless Nutrunner Nxa030s-36v-b \(0608842007\)
    Vendor
    Bosch
    Product
    Nexo Cordless Nutrunner Nxa030s-36v \(0608842002\)
    Vendor
    Bosch
    Product
    Nexo Cordless Nutrunner Nxa050s-36v-b \(0608842008\)
    Vendor
    Bosch
    Product
    Nexo Cordless Nutrunner Nxa050s-36v \(0608842003\)
    Vendor
    Bosch
    Product
    Nexo Cordless Nutrunner Nxa065s-36v-b \(0608842014\)
    Vendor
    Bosch
    Product
    Nexo Cordless Nutrunner Nxa065s-36v \(0608842013\)
    Vendor
    Bosch
    Product
    Nexo Cordless Nutrunner Nxp012qd-36v-b \(0608842010\)
    Vendor
    Bosch
    Product
    Nexo Cordless Nutrunner Nxp012qd-36v \(0608842005\)
    Vendor
    Bosch
    Product
    Nexo Cordless Nutrunner Nxv012t-36v-b \(0608842016\)
    Vendor
    Bosch
    Product
    Nexo Cordless Nutrunner Nxv012t-36v \(0608842015\)
    Vendor
    Bosch
    Product
    Nexo Special Cordless Nutrunner \(0608pe2272\)
    Vendor
    Bosch
    Product
    Nexo Special Cordless Nutrunner \(0608pe2301\)
    Vendor
    Bosch
    Product
    Nexo Special Cordless Nutrunner \(0608pe2514\)
    Vendor
    Bosch
    Product
    Nexo Special Cordless Nutrunner \(0608pe2515\)
    Vendor
    Bosch
    Product
    Nexo Special Cordless Nutrunner \(0608pe2666\)
    Vendor
    Bosch
    Product
    Nexo Special Cordless Nutrunner \(0608pe2673\)

    Exploits

    No exploit reference

    Related CVEs

    CVE-2023-48266 (CVSS 8.1) — The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, po…
    CVE-2023-48265 (CVSS 8.1) — The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, po…
    CVE-2023-48264 (CVSS 8.1) — The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, po…
    CVE-2023-48263 (CVSS 8.1) — The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, po…
    CVE-2023-48262 (CVSS 8.1) — The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, po…
    CVE-2023-48261 (CVSS 5.3) — The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database v…
    CVE-2023-48260 (CVSS 5.3) — The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database v…
    CVE-2023-48259 (CVSS 5.3) — The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database v…
    CVE-2023-48258 (CVSS 5.5) — The vulnerability allows a remote attacker to delete arbitrary files on the file system via a crafted URL or H…
    CVE-2023-48256 (CVSS 5.3) — The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP respon…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High