CVE-2025-60038: Rexroth IndraWorks RCE Vulnerability

CVE-2025-60038 Overview

A vulnerability has been identified in Rexroth IndraWorks, a Bosch Rexroth industrial automation engineering software suite. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file containing malicious serialized data. Exploitation requires user interaction, specifically opening a specially crafted file, which then causes the application to deserialize the malicious data, enabling Remote Code Execution (RCE). This can lead to a complete compromise of the system running Rexroth IndraWorks.

Critical Impact

Successful exploitation of this insecure deserialization vulnerability can result in complete system compromise, allowing attackers to execute arbitrary code with the privileges of the user running Rexroth IndraWorks, potentially leading to data theft, malware installation, or lateral movement within industrial control system networks.

Affected Products

• Rexroth IndraWorks (all versions prior to patch)
• Bosch Rexroth industrial automation environments utilizing IndraWorks engineering software
• Systems processing IndraWorks project files from untrusted sources

Discovery Timeline

• 2026-02-18 - CVE-2025-60038 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-60038

Vulnerability Analysis

This vulnerability is classified as Insecure Deserialization (CWE-502), a dangerous class of vulnerability where untrusted data is passed to a deserialization function without proper validation. In the context of Rexroth IndraWorks, when a user opens a specially crafted project file or data file, the application processes serialized objects embedded within the file. Due to insufficient validation of the serialized data, an attacker can embed malicious objects that, when deserialized, trigger arbitrary code execution.

The vulnerability requires local access (user must open the malicious file) and user interaction, but once the file is opened, exploitation occurs automatically during the parsing process. The impact is severe as successful exploitation grants full control over the affected system with the same privileges as the IndraWorks process.

Root Cause

The root cause of this vulnerability is the improper handling of serialized data during file parsing operations within Rexroth IndraWorks. The application fails to adequately validate or sanitize serialized objects before deserialization, allowing attackers to inject malicious object graphs that execute arbitrary code when reconstructed by the deserializer. This is a common issue in applications that serialize complex objects for storage or transmission without implementing proper type whitelisting or integrity checks.

Attack Vector

The attack vector is local, requiring an attacker to deliver a malicious file to the victim through social engineering methods such as phishing emails, compromised file shares, or malicious downloads. The attacker crafts a file that appears to be a legitimate IndraWorks project or configuration file but contains malicious serialized payloads. When the victim opens this file within the IndraWorks application, the deserialization process executes the embedded malicious code without further user interaction.

In industrial control system (ICS) environments, this attack is particularly concerning as engineering workstations often have elevated access to operational technology (OT) networks. Compromising an IndraWorks installation could provide attackers with a foothold for further attacks against industrial systems.

Detection Methods for CVE-2025-60038

Indicators of Compromise

• Unexpected child processes spawned by the IndraWorks application (IndraWorks.exe or related executables)
• Unusual network connections originating from IndraWorks processes
• Suspicious file access patterns following the opening of project files
• Evidence of serialized object payloads in IndraWorks file formats

Detection Strategies

• Monitor process creation events for anomalous child processes of IndraWorks executables
• Implement endpoint detection rules to identify deserialization attack patterns and suspicious process chains
• Deploy file integrity monitoring on IndraWorks project directories to detect manipulated files
• Utilize behavioral analysis to detect code execution following file open operations

Monitoring Recommendations

• Enable detailed logging for IndraWorks application activities and file operations
• Configure SIEM rules to correlate file open events with subsequent suspicious process creation
• Monitor for attempts to download or transfer IndraWorks project files from external sources
• Implement email gateway scanning for IndraWorks file attachments from untrusted senders

How to Mitigate CVE-2025-60038

Immediate Actions Required

• Apply security patches from Bosch Rexroth as soon as available by consulting the Bosch Security Advisory BOSCH-SA-591522
• Restrict opening of IndraWorks project files to only those from trusted and verified sources
• Implement network segmentation to isolate engineering workstations running IndraWorks
• Train users on recognizing social engineering attempts delivering malicious project files

Patch Information

Bosch Rexroth has released a security advisory addressing this vulnerability. Administrators should consult the Bosch Security Advisory BOSCH-SA-591522 for detailed patch information, affected version numbers, and remediation guidance. It is strongly recommended to apply vendor patches immediately to eliminate the vulnerability.

Workarounds

• Implement strict file validation procedures before opening any IndraWorks files received externally
• Use application whitelisting to prevent unauthorized code execution from IndraWorks processes
• Deploy endpoint protection solutions capable of detecting deserialization attacks and anomalous process behavior
• Consider running IndraWorks in isolated virtual environments when processing files from untrusted sources
• Disable or restrict network access for IndraWorks workstations to limit post-exploitation lateral movement