PT-2024-13562 · Rexroth+1 · Nexo Cordless Nutrunner Nxa011S-36V+8

Andrea Palanca · Published 2024-01-10 · Updated 2024-01-18 · CVE-2023-48255

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description The issue allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code and obtain its execution inside a victim’s session. This can be achieved via a crafted URL, HTTP request, or by waiting for the victim to view a poisoned log.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-48255

Affected Products

Nexo Cordless Nutrunner Nxa011S-36V

Nexo Cordless Nutrunner Nxa015S-36V

Nexo Cordless Nutrunner Nxa030S-36V

Nexo Cordless Nutrunner Nxa050S-36V

Nexo Cordless Nutrunner Nxa065S-36V

Nexo Cordless Nutrunner Nxp012Qd-36V

Nexo Cordless Nutrunner Nxp012Qd-36V-B

Bosch Nexo Special Cordless Nutrunner

Nexo-Os

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-48255 · Security Note
• https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-48255 · Vendor Advisory
• https://twitter.com/CVEnew/status/1745077426172973265 · Twitter Post
• https://t.me/cvenotify/67902 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1745111897278402583 · Twitter Post