Full Report
Ruggedcom Rox contains an input validation vulnerability in the feature key installation process that could allow an authenticated remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Siemens has released new versions for the affected products and recommends to update to the latest versions.
Analysis Summary
# Vulnerability: Remote Code Execution in Ruggedcom Rox Feature Key Installation
## CVE Details
- **CVE ID:** CVE-2025-40947
- **CVSS Score:** 7.5 (High) via CVSS v3.1 / 7.7 (High) via CVSS v4.0
- **CWE:** CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
## Affected Systems
- **Products:** RUGGEDCOM ROX II family, specifically:
- RUGGEDCOM ROX MX5000
- RUGGEDCOM ROX MX5000RE
- RUGGEDCOM ROX RX1400
- RUGGEDCOM ROX RX1500 series (RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536)
- RUGGEDCOM ROX RX5000
- **Versions:** All versions prior to V2.17.1
- **Configurations:** Devices utilizing the feature key installation process.
## Vulnerability Description
Affected devices fail to properly sanitize user-supplied input during the feature key installation process. An authenticated remote attacker can exploit this lack of input validation to inject arbitrary OS commands. Successful exploitation grants the attacker executive control over the underlying operating system with **root privileges**.
## Exploitation
- **Status:** Not reported as exploited in the wild; discovered by researchers (Palo Alto Networks OT Threat Research Lab).
- **Complexity:** High (Requires authentication and specific interaction with the feature key process).
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Full access to the underlying OS)
- **Integrity:** High (Ability to modify system files and configurations)
- **Availability:** High (Potential for complete system takeover or shut down)
## Remediation
### Patches
Siemens recommends upgrading to the following version:
- **RUGGEDCOM ROX II (All Models):** Update to **V2.17.1** or later.
### Workarounds
No specific technical workarounds are provided. General security mitigations include:
- Restricting network access to the management interface of the devices.
- Adhering to Siemens' operational guidelines for Industrial Security.
## Detection
- **Indicators of Compromise:** Unusual activity involving the feature key installation logs or unauthorized changes to the underlying OS filesystem.
- **Detection methods and tools:** Monitor network traffic for suspicious payloads sent to management interfaces, particularly those targeting feature key management functions. Audit user accounts for unauthorized authentication attempts.
## References
- **Vendor Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/html/ssa-078743[.]html
- **Support Link:** hxxps[://]support[.]industry[.]siemens[.]com/cs/ww/en/view/110002017/
- **Siemens Industrial Security Guidelines:** hxxps[://]www[.]siemens[.]com/cert/operational-guidelines-industrial-security