CVE-2025-48862

{"id": "CVE-2025-48862", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@bosch.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.5}]}, "published": "2025-08-14T09:15:26.293", "references": [{"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-129652.html", "source": "psirt@bosch.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@bosch.com", "description": [{"lang": "en", "value": "CWE-311"}, {"lang": "en", "value": "CWE-1104"}]}], "descriptions": [{"lang": "en", "value": "Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set. However, only the private key -\u00a0if available in the backup - is encrypted, while the backup file itself remains unencrypted."}, {"lang": "es", "value": "La redacci\u00f3n ambigua en la interfaz web del mecanismo de configuraci\u00f3n de CtrlX OS podr\u00eda inducir al usuario a creer que el archivo de copia de seguridad est\u00e1 cifrado al establecer una contrase\u00f1a. Sin embargo, solo se cifra la clave privada (si est\u00e1 disponible en la copia de seguridad), mientras que el archivo de copia de seguridad permanece sin cifrar."}], "lastModified": "2025-08-14T13:11:53.633", "sourceIdentifier": "psirt@bosch.com"}