CVE-2023-48254 Cross-site scripting in Nexo cordless nutrunner NXA011S-36V (0608842011)

Medium 5.3 Published 10 Jan 2024 Updated 17 Jun 2025

Remote attackers can inject arbitrary client-side scripts into the web interface of Bosch Rexroth Nexo cordless nutrunners via crafted URLs.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-48254?

CVE-2023-48254 is a medium-severity cross-site scripting vulnerability in Rexroth Nexo cordless nutrunner NXA011S-36V (0608842011), published on 10 Jan 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request.

Weakness: CWE-79

Which versions are affected by CVE-2023-48254?

It affects 1 product.

Products include Bosch Nexo-Os.

How do I fix CVE-2023-48254?

No fix has been published for CVE-2023-48254 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-48254 being exploited?

There is no known exploitation of CVE-2023-48254 in the wild and no public exploit code.

Sources

Also known as GHSA-x9fw-89r9-9phc.