CVE-2025-60036 is a vulnerability identified in the UA.Testclient utility component of Bosch Rexroth's IndraWorks software suite, affecting all versions prior to 15V24. The root cause is unsafe deserialization of untrusted data (CWE-502), where the application parses serialized data from files without proper validation or sanitization. An attacker can craft a malicious serialized file that, when opened by a user in UA.Testclient, triggers deserialization of harmful payloads leading to remote code execution (RCE). This flaw requires user interaction—specifically, the victim must open the malicious file—but does not require any prior authentication or elevated privileges. The CVSS 3.1 base score is 7.8 (high), reflecting the vulnerability's potential to compromise confidentiality, integrity, and availability of the affected system. The attack vector is local (AV:L), with low attack complexity (AC:L), no privileges required (PR:N), but user interaction is necessary (UI:R). The vulnerability scope is unchanged (S:U), meaning the exploit affects only the vulnerable component. No public exploits have been reported yet, but the risk remains significant given the critical nature of industrial control systems that rely on IndraWorks. The vulnerability could allow attackers to gain full control over systems running UA.Testclient, potentially disrupting industrial processes or causing data breaches.

For European organizations, especially those in industrial automation, manufacturing, and critical infrastructure sectors, this vulnerability poses a serious risk. Bosch Rexroth IndraWorks is widely used in European factories and industrial plants for automation control and configuration. Exploitation could lead to unauthorized control over industrial systems, causing operational disruptions, safety hazards, and potential data exfiltration. The compromise of such systems could have cascading effects on supply chains and critical services. Confidentiality breaches could expose sensitive operational data, while integrity and availability impacts could halt production lines or cause unsafe conditions. The requirement for user interaction somewhat limits mass exploitation but targeted spear-phishing or social engineering attacks could be effective. Given the strategic importance of industrial automation in Europe, the impact could be severe in countries with large manufacturing bases.

1. Apply official patches or updates from Bosch Rexroth as soon as they become available to address this vulnerability. 2. Until patches are released, restrict the use of UA.Testclient to trusted personnel and environments. 3. Implement strict file handling policies to prevent opening files from untrusted or unknown sources within UA.Testclient. 4. Employ application whitelisting and endpoint protection solutions to detect and block suspicious deserialization behaviors or code execution attempts. 5. Conduct user training focused on recognizing phishing and social engineering attempts that might deliver malicious files. 6. Monitor network and host logs for unusual activities related to UA.Testclient processes. 7. Consider isolating or sandboxing UA.Testclient usage environments to limit potential damage from exploitation. 8. Coordinate with Bosch Rexroth support for guidance and early access to patches or workarounds.