CVE-2025-60035

High

Published: 18 February 2026

Published

18 February 2026

Modified

24 February 2026

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0018 39.7th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-60035 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Bosch Rexroth Indraworks. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 39.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the deserialization vulnerability by identifying, reporting, and correcting the flaw through timely application of vendor patches for versions prior to 15V24.

SI-10 Information Input Validation good match

prevent

Validates manipulated file inputs containing serialized data before deserialization to ensure they are well-formed and free of malicious content.

SI-16 Memory Protection partial match

prevent

Implements memory safeguards like DEP and ASLR to protect against arbitrary code execution resulting from successful deserialization of malicious data.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

Why these techniques?

Deserialization vulnerability (CWE-502) in OPC.Testclient enables arbitrary code execution (RCE) via user interaction with a crafted file, directly facilitating Exploitation for Client Execution (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

A vulnerability has been identified in the OPC.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are affected. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file…

containing malicious serialized data. Exploitation requires user interaction, specifically opening a specially crafted file, which then causes the application to deserialize the malicious data, enabling Remote Code Execution (RCE). This can lead to a complete compromise of the system running the OPC.Testclient.

Deeper analysisAI

CVE-2025-60035 is a deserialization vulnerability (CWE-502) in the OPC.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are affected. The flaw enables arbitrary code execution when the application parses a manipulated file containing malicious serialized data.

Exploitation requires local access (AV:L) with low complexity (AC:L) and no privileges (PR:N), but user interaction (UI:R) is necessary—the victim must open a specially crafted file in OPC.Testclient, triggering deserialization of the malicious data. This leads to remote code execution (RCE) with high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), potentially resulting in complete compromise of the system running the utility. The CVSS v3.1 base score is 7.8.

Mitigation details are available in the Bosch PSIRT security advisory at https://psirt.bosch.com/security-advisories/BOSCH-SA-591522.html.