CVE-2023-48243 HIGH

CVE-2023-48243

Vendor Rexroth
Product Nexo cordless nutrunner NXA015S-36V (0608842001)
Weakness CWE-22 · Path traversal
Published January 10, 2024
Last update June 17, 2025
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

What the vulnerability does

01Description

The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By abusing this vulnerability, it is possible to obtain remote code execution (RCE) with root privileges on the device.

Key dates

02Disclosure timeline

January 10, 2024 CVE published
June 17, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-25688 IBM Security Key Lifecycle Manager information disclosure CVE-2024-37089 WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Unauthenticated Local File Inclusion vulnerability CVE-2025-64765 Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values CVE-2026-24479 HUSTOJ has Arbitrary File Write (Zip Slip) in Problem Import Modules that leads to RCE CVE-2026-39307 PraisonAI has an Arbitrary File Write (Zip Slip) in Templates Extraction