Full Report
Multiple vulnerabilities affect the RUGGEDCOM Operating System (ROS). Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in RUGGEDCOM ROS Devices
## CVE Details
- **CVE-2025-41224**
- **CVSS Score:** 8.8 (High)
- **CWE:** CWE-693: Protection Mechanism Failure
- **CVE-2025-41222**
- **CVSS Score:** 5.3 (Medium)
- **CWE:** CWE-755: Improper Handling of Exceptional Conditions
- **CVE-2025-41223**
- **CVSS Score:** 4.8 (Medium)
- **CWE:** CWE-327: Use of a Broken or Risky Cryptographic Algorithm
- **CVE-2023-52236**
- **CVSS Score:** Not explicitly listed in text (mentioned as affected)
## Affected Systems
- **Products:** RUGGEDCOM ROS V4.X family devices.
- **Specific Models:**
- RUGGEDCOM i800, i801, i802, i803
- RUGGEDCOM M2100, M2200
- RUGGEDCOM M969
- **Versions:** All versions of the above products are currently affected.
- **Configurations:** Systems changing from management to non-management interface configurations (specifically for CVE-2025-41224).
## Vulnerability Description
This advisory covers three primary technical flaws in the RUGGEDCOM Operating System (ROS):
1. **Interface Access Persistence (CVE-2025-41224):** The OS fails to immediately enforce restricted interface access when shifting from a management to a non-management configuration. SSH access remains active on unauthorized interfaces until a full system reboot occurs.
2. **TLS Handshake DoS (CVE-2025-41222):** The web server fails to process malformed TLS handshake messages correctly. Processing such messages can trigger a device crash, resulting in a Denial of Service (DoS).
3. **Weak Cryptography (CVE-2025-41223):** The devices support the `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256` cipher suite. The use of CBC (Cipher Block Chaining) mode makes the encrypted communication susceptible to timing attacks.
## Exploitation
- **Status:** No reports of exploitation in the wild; no PoC currently cited in the advisory.
- **Complexity:**
- **Low:** For CVE-2025-41224 and CVE-2025-41222.
- **High:** For CVE-2025-41223 (Timing attacks).
- **Attack Vector:**
- **Network:** For TLS-related vulnerabilities (CVE-2025-41222, CVE-2025-41223).
- **Adjacent:** For interface access restrictions (CVE-2025-41224).
## Impact
- **Confidentiality:** High (Potential for traffic interception via timing attacks or unauthorized SSH access).
- **Integrity:** High (Potential for unauthorized configuration changes via SSH).
- **Availability:** High (Device crashes possible via malformed TLS packets).
## Remediation
### Patches
Siemens is preparing fix versions. Users are advised to monitor the Siemens ProductCERT portal for the release of new ROS versions for the i800 and M-series families.
### Workarounds
- **Reboot after Configuration:** For CVE-2025-41224, ensure the device is manually rebooted immediately after changing management interface settings.
- **Network Segmentation:** Restrict web server access (HTTP/HTTPS) to trusted management networks only to mitigate DoS and timing attacks.
- **Disable Web Interface:** If not strictly required for operations, disable the web-based management service.
## Detection
- **Indicators of Compromise:** Unusual SSH sessions originating from interfaces previously designated as management but recently re-tasked as non-management.
- **Monitoring:** Log and monitor failed TLS handshakes and unexpected device reboots (internal crashes).
## References
- **Vendor Advisory:** hxxps://cert-portal[.]siemens[.]com/productcert/html/ssa-083019[.]html
- **Siemens ProductCERT:** hxxps://www[.]siemens[.]com/cert/advisories