ZDI-CAN-28112: ZDI-26-110: Bosch Rexroth IndraWorks Print Settings File Parsing Deserialization Of Untrusted Data Remote Code Execution Vulnerability

Published Feb 19, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bosch Rexroth IndraWorks. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-60037, CVE-2025-60038.

Affected Software

1 affected component

Bosch Rexroth Indraworks

Event History

Feb 19, 2026

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-28112?

ZDI-CAN-28112 is rated as a critical vulnerability due to its potential for remote code execution.

How do I fix ZDI-CAN-28112?

To fix ZDI-CAN-28112, users should update to the latest version of Bosch Rexroth IndraWorks as soon as a patch is available.

What are the potential impacts of ZDI-CAN-28112?

The potential impacts of ZDI-CAN-28112 include arbitrary code execution, which can lead to unauthorized access to system resources.

Is user interaction required to exploit ZDI-CAN-28112?

Yes, user interaction is required to exploit ZDI-CAN-28112.

Which software products are affected by ZDI-CAN-28112?

ZDI-CAN-28112 affects Bosch Rexroth IndraWorks installations.