CVE-2025-60036 Overview
A critical insecure deserialization vulnerability has been identified in the UA.Testclient utility, which is included in Bosch Rexroth IndraWorks. All versions prior to 15V24 are affected by this security flaw. The vulnerability allows an attacker to execute arbitrary code on a user's system by parsing a manipulated file containing malicious serialized data.
Exploitation requires user interaction, specifically opening a specially crafted file, which then causes the application to deserialize the malicious data, enabling Remote Code Execution (RCE). Successful exploitation can lead to a complete compromise of the system running the UA.Testclient.
Critical Impact
This insecure deserialization vulnerability (CWE-502) enables attackers to achieve complete system compromise through malicious file parsing, potentially affecting industrial automation environments running Bosch Rexroth IndraWorks.
Affected Products
- Bosch Rexroth IndraWorks UA.Testclient (all versions prior to 15V24)
Discovery Timeline
- 2026-02-18 - CVE-2025-60036 published to NVD
- 2026-02-18 - Last updated in NVD database
Technical Details for CVE-2025-60036
Vulnerability Analysis
This vulnerability is classified as Insecure Deserialization (CWE-502), a dangerous weakness that occurs when an application deserializes untrusted data without proper validation. In the context of the UA.Testclient utility within Bosch Rexroth IndraWorks, the application fails to adequately validate serialized data contained within files before processing them.
When a user opens a maliciously crafted file, the application processes the embedded serialized data without sufficient security controls. This allows an attacker to inject arbitrary objects into the deserialization stream, which can then be leveraged to execute code within the context of the application.
The local attack vector requires user interaction—specifically, the victim must be tricked into opening a malicious file. However, once executed, the attacker gains the ability to run arbitrary code with the privileges of the user running the UA.Testclient application, potentially leading to complete system compromise.
Root Cause
The root cause of CVE-2025-60036 is the improper handling of serialized data within the UA.Testclient utility. The application lacks proper validation and sanitization mechanisms when deserializing objects from user-supplied files. This allows attackers to craft malicious serialized payloads that, when processed by the application, instantiate arbitrary objects and execute attacker-controlled code.
The absence of type whitelisting, integrity verification, or secure deserialization practices creates an exploitable condition where untrusted input can directly influence the application's runtime behavior.
Attack Vector
The attack vector for this vulnerability requires local access and user interaction:
- Payload Crafting: An attacker creates a malicious file containing specially crafted serialized data with embedded code execution payloads
- Social Engineering: The attacker delivers the malicious file to the victim through email, file sharing, or other distribution methods
- User Interaction: The victim opens the malicious file using the UA.Testclient utility
- Deserialization: The application processes the file and deserializes the malicious payload without proper validation
- Code Execution: The crafted serialized objects trigger arbitrary code execution within the application context
The vulnerability manifests during file parsing when the UA.Testclient processes serialized data structures. Attackers can leverage known deserialization gadget chains to construct payloads that execute arbitrary commands upon deserialization. For detailed technical information about this vulnerability and exploitation techniques, refer to the Bosch Security Advisory BOSCH-SA-591522.
Detection Methods for CVE-2025-60036
Indicators of Compromise
- Unexpected child processes spawned by the UA.Testclient application
- Unusual network connections originating from the UA.Testclient process
- Suspicious file access patterns or file system modifications following the opening of project files
- Anomalous system commands executed in the context of the IndraWorks user session
Detection Strategies
- Monitor process execution trees for UA.Testclient spawning unexpected child processes such as cmd.exe, powershell.exe, or other scripting interpreters
- Implement file integrity monitoring on systems running Bosch Rexroth IndraWorks to detect unauthorized modifications
- Deploy endpoint detection and response (EDR) solutions to identify deserialization attack patterns and suspicious object instantiation
Monitoring Recommendations
- Enable enhanced logging for the UA.Testclient application and monitor for error conditions or crashes that may indicate exploitation attempts
- Configure security information and event management (SIEM) rules to alert on anomalous behavior from industrial automation software
- Establish baseline behavior profiles for IndraWorks installations to identify deviations indicative of compromise
How to Mitigate CVE-2025-60036
Immediate Actions Required
- Upgrade Bosch Rexroth IndraWorks to version 15V24 or later immediately
- Restrict file sources—only open UA.Testclient files from trusted and verified sources
- Implement application whitelisting to prevent unauthorized executables from running in the context of the UA.Testclient
- Educate users about the risks of opening files from untrusted sources, particularly those received via email or downloaded from the internet
Patch Information
Bosch has released a patched version of Rexroth IndraWorks (15V24) that addresses this insecure deserialization vulnerability. Organizations using affected versions should apply the update as soon as possible. For official patch details and download information, consult the Bosch Security Advisory BOSCH-SA-591522.
Workarounds
- Implement strict file handling policies that require all UA.Testclient files to be scanned by antimalware solutions before opening
- Run the UA.Testclient application in a sandboxed or virtualized environment to contain potential exploitation
- Apply the principle of least privilege to user accounts running IndraWorks, limiting the impact of successful exploitation
- Consider network segmentation to isolate industrial automation systems from general-purpose workstations
# Configuration example - Restrict execution policies for IndraWorks environment
# Windows PowerShell execution policy restriction for defense-in-depth
Set-ExecutionPolicy -ExecutionPolicy Restricted -Scope CurrentUser
# Enable Windows Defender Application Control (WDAC) for application whitelisting
# Refer to Microsoft documentation for WDAC policy configuration
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
