CVE-2025-60037: Rexroth IndraWorks RCE Vulnerability

CVE-2025-60037 Overview

A vulnerability has been identified in Rexroth IndraWorks that allows attackers to execute arbitrary code on users' systems through insecure deserialization. This flaw enables Remote Code Execution (RCE) when a user opens a specially crafted file containing malicious serialized data, potentially leading to complete system compromise.

Critical Impact

Successful exploitation allows attackers to achieve Remote Code Execution (RCE), potentially resulting in complete compromise of systems running Rexroth IndraWorks industrial automation software.

Affected Products

• Rexroth IndraWorks (specific versions not disclosed in CVE data)

Discovery Timeline

• February 18, 2026 - CVE-2025-60037 published to NVD
• February 18, 2026 - Last updated in NVD database

Technical Details for CVE-2025-60037

Vulnerability Analysis

This vulnerability is classified as CWE-502: Deserialization of Untrusted Data. The flaw exists in how Rexroth IndraWorks processes and deserializes data from files. When the application parses a manipulated file, it fails to properly validate the serialized data before deserialization, allowing malicious objects to be instantiated and executed.

The attack requires user interaction—specifically, convincing a user to open a malicious file. Once opened, the application's deserialization routine processes the embedded malicious data, triggering arbitrary code execution with the privileges of the user running IndraWorks. Given that industrial automation software like IndraWorks is often run with elevated privileges for hardware access, successful exploitation could have severe consequences for operational technology (OT) environments.

Root Cause

The root cause of CVE-2025-60037 is improper handling of serialized data during file parsing operations. The application deserializes untrusted data without adequate validation or sanitization, allowing attackers to craft malicious serialized objects that execute arbitrary code upon deserialization. This is a common vulnerability pattern in applications that use serialization for data persistence or transfer without implementing proper security controls.

Attack Vector

The attack vector is local, requiring user interaction to open a malicious file. An attacker would need to:

1. Craft a file containing malicious serialized data designed to exploit the deserialization vulnerability
2. Deliver the malicious file to the target user via email attachment, file share, or other social engineering methods
3. Convince the user to open the file with Rexroth IndraWorks
4. Upon file parsing, the malicious serialized data is deserialized, triggering code execution

The vulnerability exploitation does not require prior authentication or privileges on the target system, but does rely on social engineering to achieve the initial file opening interaction.

Detection Methods for CVE-2025-60037

Indicators of Compromise

• Unexpected child processes spawned by IndraWorks application processes
• Unusual network connections originating from IndraWorks processes
• Anomalous file system activity following IndraWorks file operations
• Suspicious deserialization-related error messages in application logs

Detection Strategies

• Monitor process creation events for suspicious child processes spawned by IndraWorks executables
• Implement file integrity monitoring on systems running IndraWorks
• Deploy endpoint detection and response (EDR) solutions to identify post-exploitation activity
• Configure application whitelisting to prevent unauthorized code execution

Monitoring Recommendations

• Enable verbose logging for IndraWorks application events
• Monitor for unusual file access patterns, particularly for files with non-standard extensions
• Implement network traffic analysis to detect command-and-control communications
• Review system event logs for process injection or privilege escalation attempts

How to Mitigate CVE-2025-60037

Immediate Actions Required

• Review the Bosch Security Advisory BOSCH-SA-591522 for vendor-specific guidance
• Restrict which files can be opened by IndraWorks to trusted sources only
• Implement application control policies to limit code execution capabilities
• Train users to avoid opening untrusted files, especially those received from unknown sources

Patch Information

Bosch has released a security advisory addressing this vulnerability. Organizations should consult the Bosch Security Advisory BOSCH-SA-591522 for detailed patch information and updated software versions. Apply vendor-provided patches as soon as they become available following standard change management procedures.

Workarounds

• Implement strict file handling policies to prevent users from opening files from untrusted sources
• Use network segmentation to isolate systems running IndraWorks from general-purpose networks
• Apply the principle of least privilege to user accounts running IndraWorks
• Consider deploying application sandboxing solutions to contain potential exploitation attempts