No PoC, No Problem: Rediscovering CVE-2025-29902 in the Telex RDC Server

This report documents discovery and exploitation of CVE-2025-29902 in Bosch Telex RDC Server: an unauthenticated /api/v1/resources path-traversal file upload in versions prior to 1.3.0 that allows arbitrary file writes. The author obtained the vulnerable v1.2 build, confirmed unauthenticated uploads to arbitrary paths, used the write to replace SystemConfiguration.txt (gaining admin access) and then overwrite a bundled openssl.exe to achieve remote code execution as administrator; mitigations are to patch to v1.3.0 or later and VLink 6.6.0 or later.