TL;DR

Bosch Rexroth IndraWorks UA.TestClient has a deserialization flaw that allows remote code execution when processing untrusted XML files.

What happened

['Vulnerability in IndraWorks UA.TestClient', 'Improper handling of XML data leads to RCE']

Why it matters for ops

['User interaction is required', 'Attacker can execute arbitrary code remotely']

Mitigation

  • Apply patches for CVE-2025-60036
  • Restrict access to XML files
  • Monitor system logs

Action items

  • Update IndraWorks UA.TestClient to latest version
  • Implement network segmentation

Detection IOCs

  • Unusual network traffic to/from affected systems
  • Unexpected process creation or modification

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-108/