In brief · As of October 2026
A Rexroth plant consists of ctrlX CORE as EtherCAT master with ctrlX DRIVE, ctrlX I/O (S20 modules on S20 couplers) and third-party devices on EtherCAT, or of IndraControl and IndraDrive via SERCOS III, plus HMIs and switches. From the maintenance PC the ctrlX CORE answers via OPC UA (BuildInfo), as a PROFINET device via I&M0 and as an EtherNet/IP adapter via the Identity Object; the EtherCAT and SERCOS devices behind it are seen only by the master. They get into the device list via the ctrlX Data Layer or the CORE's EtherCAT diagnostics (product code, serial number, firmware per slave) or from IndraWorks, with the material number R911… per device. Rexroth publishes via the Bosch PSIRT as HTML, without [CSAF](/glossar/#csaf): 42 advisories, two from 2026, products as material number and version range. We did not find an SBOM; for the plant you do not need one.
What hangs on a ctrlX controller and what of it is visible on the network
The controller is a ctrlX CORE with ctrlX OS and apps (PLC based on CODESYS, MOTION, EtherCAT master) or an IndraControl with IndraLogic. Attached are ctrlX DRIVE and IndraDrive, S20 couplers with S20 I/O modules (technically Axioline from Phoenix Contact with a Rexroth material number) and third-party devices via EtherCAT or SERCOS III; plus ctrlX HMI, engineering PCs with ctrlX WORKS or IndraWorks, and switches.
- Visible via IP from the maintenance PC: ctrlX CORE via OPC UA BuildInfo (ctrlX OS version), as a PROFINET device via I&M0, as an EtherNet/IP adapter via ListIdentity, plus the web interface; S20-PN couplers on PROFINET via I&M0 with their modules as submodules; switches via SNMP.
- Only via the master: all EtherCAT devices of the CORE (ctrlX DRIVE, S20 EtherCAT couplers with modules, third-party slaves) and all SERCOS III devices of an IndraControl. Their identity (Vendor ID, Product Code, Revision, serial number) is read by the master from EEPROM and object 0x1018.
- Only from the engineering: the app list of the CORE as software inventory and the drive parameters with firmware version if the master is not reachable.
How EtherCAT drives and S20 couplers get into the list: ctrlX Data Layer, IndraWorks, I&M0
The ctrlX CORE exposes its EtherCAT tree in the Data Layer, accessible via the web interface and, after enabling, via the REST interface: per slave manufacturer, product code, revision, serial number and, where present, firmware; plus ctrlX OS version and app list. For IndraControl, IndraWorks online provides the same list for SERCOS. From the network, the following are added:
- ctrlX WORKS / ctrlX OS: operating system version and installed apps (ctrlX PLC based on CODESYS, ctrlX MOTION) per ctrlX CORE – that is the software inventory the ctrlX advisories target.
- IndraWorks for IndraControl, IndraLogic and IndraDrive: project with device type and material number; the IndraWorks version itself is an advisory target (< 15V24 in February 2026).
- Network: ctrlX CORE is EtherCAT master, PROFINET device, EtherNet/IP adapter and OPC UA server – so reachable via I&M0, CIP Identity or OPC UA BuildInfo; drives behind EtherCAT only through the master. Details in the article on the network scan.
How Bosch Rexroth publishes advisories and what matching runs on
The product security page of Bosch Rexroth links to the Bosch PSIRT and a Rexroth Atom feed that contains only the ten most recent entries. We checked all paths: .well-known/csaf answers with 404 at psirt.bosch.com, boschrexroth.com and bosch.com; at CERT@VDE there is no Rexroth provider, only HTML bulletins as re-publication; the advisory text does not contain the word "csaf". That makes Bosch Rexroth the only manufacturer in this series entirely without machine-readable advisories.
| Measurement (7 Oct 2026) | Result |
|---|
| Advisories on the Rexroth page | 42 (2016–2026) |
| Bosch-wide in the PSIRT | 103, 39 of them with Rexroth relevance |
| Published in 2026 | 2 – BOSCH-SA-591522 IndraWorks (13 Feb), BOSCH-SA-466086 PRI7000/7-Zip (22 Jul) |
| Published in 2025 | 3 – ctrlX OS (2×), Rexroth fieldbus couplers |
| CSAF provider | none |
| CPE / PURL | none (no machine-readable format) |
Example BOSCH-SA-757244 (fieldbus couplers, August 2025): "Bosch Rexroth AG S20-ETH-BK (R911173905) | CVE-2025-2813 | Version(s): < 1.34", plus "S20-PN-BK+ (R911173359) … all versions". The couplers are bought-in Phoenix Contact devices with a Rexroth material number – the advisory appears at Bosch, the origin lies with Phoenix.
Without CSAF there is no product tree that could be checked against the device list by machine. Matching runs on the material number R911… or the product name with version range from the advisory table – scraping or manual work. With two to three advisories a year that is bearable; the risk lies elsewhere: anyone subscribing only to the Rexroth Atom feed does not see the PRI7000 notice from July 2026, because on the measurement day it existed only in the group-wide PSIRT.
Bought-in components (MGUARD, S20 couplers) appear twice – at Phoenix Contact as CSAF, at Bosch as HTML with a different number. The device list should carry both numbers, otherwise the same device is assessed twice or not at all. How to get suppliers without CSAF into monitoring at all is covered in a separate article.
We did not find an SBOM at Bosch Rexroth, and the ctrlX OS press release on the CRA does not mention one either; for the plant you do not need one.
What this means for installations with Rexroth components
- Carry the ctrlX OS version and app list per CORE as a software inventory; the IndraWorks version per engineering PC.
- Record the material number R911… per drive, coupler and controller – that is the only key the advisories offer.
- Carry bought-in Phoenix devices under both numbers and use the Phoenix CSAF source as the primary one.
Without CSAF every Rexroth advisory remains reading work, purchased couplers appear under two numbers, and only the CORE knows the drives behind it. In Werkspilot Scan, Bosch Rexroth is stage 2 for the controller (OPC UA, I&M0, web interface) and stage 3 for the EtherCAT devices behind it via the CORE's Data Layer. We are currently trialling the third stage with development partners on their plants.
All 13 manufacturers compared: SBOM by manufacturer →
Trial Werkspilot Scan on your own plant.
We are trialling the capture with a few plant builders on their test or reference plants, for four months, extended stage by stage around their controllers. The partner gets one plant of their choice as a plant SBOM: every reachable device with manufacturer, order number and firmware version, open items listed individually.
Ask about the development partnership →
Werkspilot keeps these devices per plant and reports when an advisory hits one of them. The figures in this article are our own measurements from 7 Oct 2026; manufacturers change feeds and pages without notice.
