RUGGEDCOM ROX RX1512 — CraftedSignal Threat Feed

Siemens RUGGEDCOM ROX Devices Vulnerable to Remote Code Execution via Feature Key Injection (CVE-2025-40947)

hello@craftedsignal.io — Tue, 12 May 2026 10:19:32 +0000

A remote code execution vulnerability, tracked as CVE-2025-40947, affects multiple RUGGEDCOM ROX devices. The affected devices include RUGGEDCOM ROX MX5000, MX5000RE, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536, and RX5000, specifically all versions prior to V2.17.1. The vulnerability stems from a failure to properly sanitize user-supplied input during the feature key installation process. An authenticated attacker can exploit this flaw to inject arbitrary commands, leading to remote code execution with root privileges on the underlying operating system. This vulnerability poses a significant risk to industrial control systems relying on these devices.

Attack Chain

An attacker gains authenticated access to the RUGGEDCOM ROX device’s management interface.
The attacker crafts a malicious feature key containing embedded operating system commands.
The attacker uploads the crafted feature key to the device through the management interface.
The RUGGEDCOM ROX device attempts to install the feature key without proper input sanitization.
The injected commands within the feature key are executed with root privileges.
The attacker gains arbitrary code execution on the device’s underlying operating system.
The attacker can then establish persistence by modifying system files.
The attacker can pivot to other internal assets, disrupt operations, or exfiltrate sensitive data.

Impact

Successful exploitation of CVE-2025-40947 allows an attacker to execute arbitrary code with root privileges on vulnerable RUGGEDCOM ROX devices. This could lead to complete system compromise, denial of service, disruption of critical infrastructure, and potential lateral movement to other systems within the network. The vulnerability targets industrial control systems, potentially impacting sectors such as energy, transportation, and manufacturing.

Recommendation

Upgrade all affected RUGGEDCOM ROX devices (MX5000, MX5000RE, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536, and RX5000) to version V2.17.1 or later to patch CVE-2025-40947.
Monitor network traffic for suspicious activity related to feature key uploads to detect potential exploitation attempts. Deploy the Sigma rule Detect Suspicious Feature Key Uploads to identify such activity.
Review the logs for any unusual processes or commands executed on the RUGGEDCOM ROX devices that may indicate successful exploitation. Utilize the Sigma rule Detect Malicious Command Execution via Feature Key Injection for this purpose.

CVE-2025-40949 - Siemens RUGGEDCOM ROX Web UI Command Injection

hello@craftedsignal.io — Tue, 12 May 2026 10:17:37 +0000

A critical command injection vulnerability, identified as CVE-2025-40949, affects multiple RUGGEDCOM ROX devices. Specifically, the vulnerability resides in the Scheduler functionality of the Web UI. Versions prior to V2.17.1 of the RUGGEDCOM ROX MX5000, MX5000RE, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536, and RX5000 are affected. The root cause of this vulnerability is the insufficient sanitization of user-supplied input, which allows an authenticated attacker to inject arbitrary commands into the task scheduling backend. Successful exploitation allows a remote attacker to execute arbitrary commands with root privileges on the underlying operating system of the affected device. This poses a significant risk to industrial control systems (ICS) environments where these devices are commonly deployed.

Attack Chain

An attacker gains authenticated access to the RUGGEDCOM ROX Web UI.
The attacker navigates to the Scheduler functionality within the Web UI.
The attacker injects malicious commands into a user-supplied input field (e.g., task name, command to execute, schedule).
The injected commands are not properly sanitized by the application.
When the scheduler processes the task, the injected commands are executed by the underlying operating system with root privileges.
The attacker achieves arbitrary command execution, potentially allowing them to install malware, modify configurations, or disrupt operations.
The attacker leverages the initial access to pivot to other network resources or maintain persistence on the device.

Impact

Successful exploitation of CVE-2025-40949 allows an authenticated remote attacker to execute arbitrary commands with root privileges on the RUGGEDCOM ROX device. This could lead to complete system compromise, allowing the attacker to disrupt critical infrastructure operations, steal sensitive data, or use the compromised device as a pivot point to attack other systems within the network. Given the widespread use of RUGGEDCOM devices in industrial control systems, the potential impact is significant and could affect various sectors, including energy, transportation, and manufacturing.

Recommendation

Upgrade all affected RUGGEDCOM ROX devices to version V2.17.1 or later to patch CVE-2025-40949.
Monitor web server logs for suspicious activity related to the Scheduler functionality of the Web UI (reference: webserver log source).
Implement the Sigma rules provided below to detect potential exploitation attempts targeting CVE-2025-40949.