Attack Chain

1. An attacker gains network access to the Siemens ROX II device, typically via its management interface.
2. The attacker exploits CVE-2025-40948, an arbitrary file disclosure vulnerability, by leveraging an insecure configuration of a root-privileged daemon executing the xz utility. By providing specific parameters (-f -c -d) and an arbitrary file path, the attacker can read any file on the switch's file system, including sensitive configuration files, password hashes, and private cryptographic keys.
3. The attacker analyzes the disclosed information to craft a malicious payload and identify writable directories for subsequent steps.
4. The attacker uses the web UI's normal file upload functionality for feature keys to upload a crafted feature key file containing a malicious script (e.g., a Python reverse shell) to a writable directory on the switch.
5. The attacker exploits CVE-2025-40947, a command injection vulnerability, by triggering the feature key validation function. This function fails to sanitize an attacker-controlled payload within the feature key's signature field, which is then inserted directly into a command executed with root privileges via the gpgv utility, granting the attacker full root access.
6. With root privileges, the attacker exploits CVE-2025-40949 by using the switch’s web management task scheduler to inject malicious commands directly into the system's root cron table.
7. The injected commands establish persistent code execution, allowing the attacker to maintain full control of the device even after reboots.
8. The attacker can now perform sustained malicious activities, such as data exfiltration from the industrial network or denial-of-service attacks against critical OT infrastructure.

Impact

The successful exploitation of these chained vulnerabilities transforms Siemens ROX II OT switches, critical components of industrial control networks, into compromised platforms. This provides attackers with persistent root access, undermining the integrity and availability of the industrial network. Such a compromise can lead to severe operational disruptions, unauthorized access to sensitive industrial processes, data exfiltration, and the potential for denial-of-service attacks. The persistence mechanism ensures that malicious activity can continue undetected across system reboots, making remediation challenging and significantly increasing the overall risk to critical infrastructure. While no specific victim counts are given, the nature of OT switches means any targeted sector utilizing these devices (e.g., manufacturing, energy, utilities) would be at risk.

Recommendation

• Patch CVE-2025-40948, CVE-2025-40947, and CVE-2025-40949 by updating affected Siemens ROX II devices to firmware version V2.17.1 immediately, as recommended in Siemens advisories SSA-973901, SSA-078743, and SSA-081142.
• Deploy the Sigma rules in this brief to your SIEM and tune them for your Linux-based OT environments, focusing on process_creation and file_event logs.
• Monitor process creation logs for unusual invocations of xz with -f -c -d parameters, indicative of CVE-2025-40948 exploitation.
• Monitor process creation logs for gpgv executions containing shell metacharacters or unexpected command line arguments, potentially indicating CVE-2025-40947 exploitation.
• Monitor file integrity and modification logs for changes to /etc/crontab or user-specific cron files on Linux systems, which could signal CVE-2025-40949 exploitation.