Eine Schwachstelle in der “Zertifikate und Schlüssel”-Funktionalität der Webanwendung von ctrlX OS ermöglicht es einem Remote-Authentifizierten (gering privilegierten) Angreifer, beliebige Zertifikate in beliebige Dateisystempfade zu schreiben.

Successful exploitation of CVE-2025-24350 could allow an attacker to compromise the trust infrastructure of a ctrlX OS device. By writing malicious certificates to the file system, an attacker could potentially impersonate legitimate entities, intercept communications, or gain unauthorized access to resources. The ability to write to arbitrary file system paths significantly expands the potential attack surface, allowing for broader impact beyond just certificate manipulation. This vulnerability could be leveraged to establish a persistent foothold within the system, enabling further reconnaissance and lateral movement.

Organizations utilizing ctrlX OS Device Admin in industrial control systems or other critical infrastructure environments are particularly at risk. Environments with weak authentication controls or shared user accounts are also more vulnerable. Any deployment relying on the integrity of certificates managed through the Device Admin web application should be considered at risk.

1. 2025-04-30Disclosure

   disclosure

1. Reserviert2025-01-20
2. Veröffentlicht2025-04-30
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-24350 is to upgrade ctrlX OS to version 2.6.9 or later, which contains the fix. If an immediate upgrade is not feasible, consider implementing stricter file system permissions to limit write access to the certificate storage directory. Implement robust input validation on any certificate-related API endpoints to prevent malicious data from being written. Monitor system logs for unusual certificate creation or modification events.