CVE-2025-60036: Rexroth IndraWorks UA.Testclient RCE Flaw

CVE-2025-60036 Overview

A critical insecure deserialization vulnerability has been identified in the UA.Testclient utility, which is included in Bosch Rexroth IndraWorks. All versions prior to 15V24 are affected by this security flaw. The vulnerability allows an attacker to execute arbitrary code on a user's system by parsing a manipulated file containing malicious serialized data.

Exploitation requires user interaction, specifically opening a specially crafted file, which then causes the application to deserialize the malicious data, enabling Remote Code Execution (RCE). Successful exploitation can lead to a complete compromise of the system running the UA.Testclient.

Critical Impact
This insecure deserialization vulnerability (CWE-502) enables attackers to achieve complete system compromise through malicious file parsing, potentially affecting industrial automation environments running Bosch Rexroth IndraWorks.

Affected Products

Bosch Rexroth IndraWorks UA.Testclient (all versions prior to 15V24)

Discovery Timeline

2026-02-18 - CVE-2025-60036 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-60036

Vulnerability Analysis

This vulnerability is classified as Insecure Deserialization (CWE-502), a dangerous weakness that occurs when an application deserializes untrusted data without proper validation. In the context of the UA.Testclient utility within Bosch Rexroth IndraWorks, the application fails to adequately validate serialized data contained within files before processing them.

When a user opens a maliciously crafted file, the application processes the embedded serialized data without sufficient security controls. This allows an attacker to inject arbitrary objects into the deserialization stream, which can then be leveraged to execute code within the context of the application.

The local attack vector requires user interaction—specifically, the victim must be tricked into opening a malicious file. However, once executed, the attacker gains the ability to run arbitrary code with the privileges of the user running the UA.Testclient application, potentially leading to complete system compromise.

Root Cause

The root cause of CVE-2025-60036 is the improper handling of serialized data within the UA.Testclient utility. The application lacks proper validation and sanitization mechanisms when deserializing objects from user-supplied files. This allows attackers to craft malicious serialized payloads that, when processed by the application, instantiate arbitrary objects and execute attacker-controlled code.

The absence of type whitelisting, integrity verification, or secure deserialization practices creates an exploitable condition where untrusted input can directly influence the application's runtime behavior.

Attack Vector

The attack vector for this vulnerability requires local access and user interaction:

Payload Crafting: An attacker creates a malicious file containing specially crafted serialized data with embedded code execution payloads
Social Engineering: The attacker delivers the malicious file to the victim through email, file sharing, or other distribution methods
User Interaction: The victim opens the malicious file using the UA.Testclient utility
Deserialization: The application processes the file and deserializes the malicious payload without proper validation
Code Execution: The crafted serialized objects trigger arbitrary code execution within the application context

The vulnerability manifests during file parsing when the UA.Testclient processes serialized data structures. Attackers can leverage known deserialization gadget chains to construct payloads that execute arbitrary commands upon deserialization. For detailed technical information about this vulnerability and exploitation techniques, refer to the Bosch Security Advisory BOSCH-SA-591522.

Detection Methods for CVE-2025-60036

Indicators of Compromise

Unexpected child processes spawned by the UA.Testclient application
Unusual network connections originating from the UA.Testclient process
Suspicious file access patterns or file system modifications following the opening of project files
Anomalous system commands executed in the context of the IndraWorks user session

Detection Strategies

Monitor process execution trees for UA.Testclient spawning unexpected child processes such as cmd.exe, powershell.exe, or other scripting interpreters
Implement file integrity monitoring on systems running Bosch Rexroth IndraWorks to detect unauthorized modifications
Deploy endpoint detection and response (EDR) solutions to identify deserialization attack patterns and suspicious object instantiation

Monitoring Recommendations

Enable enhanced logging for the UA.Testclient application and monitor for error conditions or crashes that may indicate exploitation attempts
Configure security information and event management (SIEM) rules to alert on anomalous behavior from industrial automation software
Establish baseline behavior profiles for IndraWorks installations to identify deviations indicative of compromise

How to Mitigate CVE-2025-60036

Immediate Actions Required

Upgrade Bosch Rexroth IndraWorks to version 15V24 or later immediately
Restrict file sources—only open UA.Testclient files from trusted and verified sources
Implement application whitelisting to prevent unauthorized executables from running in the context of the UA.Testclient
Educate users about the risks of opening files from untrusted sources, particularly those received via email or downloaded from the internet

Patch Information

Bosch has released a patched version of Rexroth IndraWorks (15V24) that addresses this insecure deserialization vulnerability. Organizations using affected versions should apply the update as soon as possible. For official patch details and download information, consult the Bosch Security Advisory BOSCH-SA-591522.

Workarounds

Implement strict file handling policies that require all UA.Testclient files to be scanned by antimalware solutions before opening
Run the UA.Testclient application in a sandboxed or virtualized environment to contain potential exploitation
Apply the principle of least privilege to user accounts running IndraWorks, limiting the impact of successful exploitation
Consider network segmentation to isolate industrial automation systems from general-purpose workstations

bash

# Configuration example - Restrict execution policies for IndraWorks environment
# Windows PowerShell execution policy restriction for defense-in-depth
Set-ExecutionPolicy -ExecutionPolicy Restricted -Scope CurrentUser

# Enable Windows Defender Application Control (WDAC) for application whitelisting
# Refer to Microsoft documentation for WDAC policy configuration