The vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP request, or simply by waiting for the victim to view the poisoned log.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00147.

Exploitation none

Automatable yes

Technical Impact total

Affected Vendors & Products

Vendors Products
Bosch
  • Nexo-os
  • Nexo Cordless Nutrunner Nxa011s-36v-b \(0608842012\)
  • Nexo Cordless Nutrunner Nxa011s-36v \(0608842011\)
  • Nexo Cordless Nutrunner Nxa015s-36v-b \(0608842006\)
  • Nexo Cordless Nutrunner Nxa015s-36v \(0608842001\)
  • Nexo Cordless Nutrunner Nxa030s-36v-b \(0608842007\)
  • Nexo Cordless Nutrunner Nxa030s-36v \(0608842002\)
  • Nexo Cordless Nutrunner Nxa050s-36v-b \(0608842008\)
  • Nexo Cordless Nutrunner Nxa050s-36v \(0608842003\)
  • Nexo Cordless Nutrunner Nxa065s-36v-b \(0608842014\)
  • Nexo Cordless Nutrunner Nxa065s-36v \(0608842013\)
  • Nexo Cordless Nutrunner Nxp012qd-36v-b \(0608842010\)
  • Nexo Cordless Nutrunner Nxp012qd-36v \(0608842005\)
  • Nexo Cordless Nutrunner Nxv012t-36v-b \(0608842016\)
  • Nexo Cordless Nutrunner Nxv012t-36v \(0608842015\)
  • Nexo Special Cordless Nutrunner \(0608pe2272\)
  • Nexo Special Cordless Nutrunner \(0608pe2301\)
  • Nexo Special Cordless Nutrunner \(0608pe2514\)
  • Nexo Special Cordless Nutrunner \(0608pe2515\)
  • Nexo Special Cordless Nutrunner \(0608pe2666\)
  • Nexo Special Cordless Nutrunner \(0608pe2673\)

Configuration 1 [-]

AND
cpe:2.3:o:bosch:nexo-os:*:*:*:*:*:*:*:*
OR cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa011s-36v-b_\(0608842012\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa011s-36v_\(0608842011\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa015s-36v-b_\(0608842006\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa015s-36v_\(0608842001\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa030s-36v-b_\(0608842007\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa030s-36v_\(0608842002\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa050s-36v-b_\(0608842008\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa050s-36v_\(0608842003\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa065s-36v-b_\(0608842014\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxa065s-36v_\(0608842013\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxp012qd-36v-b_\(0608842010\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxp012qd-36v_\(0608842005\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxv012t-36v-b_\(0608842016\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_cordless_nutrunner_nxv012t-36v_\(0608842015\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2272\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2301\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2514\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2515\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2666\):-:*:*:*:*:*:*:*
cpe:2.3:h:bosch:nexo_special_cordless_nutrunner_\(0608pe2673\):-:*:*:*:*:*:*:*

No data.

No data.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-52324 The vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP request, or simply by waiting for the victim to view the poisoned log.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://psirt.bosch.com/security-advisories/BOSCH-SA-711465.html cve-icon cve-icon
History

Tue, 17 Jun 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
cve-icon MITRE

Status: PUBLISHED

Assigner: bosch

Published:

Updated: 2025-06-17T20:59:13.975Z

Reserved: 2023-11-13T13:44:23.705Z

Link: CVE-2023-48255

cve-icon Vulnrichment

Updated: 2024-08-02T21:23:39.444Z

cve-icon NVD

Status : Modified

Published: 2024-01-10T13:15:46.200

Modified: 2024-11-21T08:31:20.030

Link: CVE-2023-48255

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.