---
schema: 1
kind: vulnerability
title: "CVE-2025-40948/-40947/-40949 — Siemens RUGGEDCOM ROX II: Unit 42 chains three OT-switch flaws to persistent root"
headline: "Unit 42 publishes a full RUGGEDCOM ROX II exploit chain — file disclosure, feature-key command injection, and task-scheduler persistence to root"
summary: >
  Palo Alto Unit 42 published (2026-07-17) a three-stage exploit chain against Siemens RUGGEDCOM ROX II
  operational-technology switches: CVE-2025-40948 (CVSS 6.8) misuses a root-privileged xz invocation to
  read any file on the device, CVE-2025-40947 (CVSS 7.5) is command injection in the feature-key
  signature-verification path, and CVE-2025-40949 (CVSS 9.1) lets an authenticated attacker inject
  commands into the web-management task scheduler for persistent, reboot-surviving root code execution.
  Siemens patched all three in firmware V2.17.1 (advisories SSA-973901/-078743/-081142); no in-the-wild
  exploitation is reported. ROX II sits as a network-security/routing boundary inside rail, utility,
  water and manufacturing networks across Europe.
discovered_at: "2026-07-18T04:35:00Z"
event_date: "2026-07-17"
run_id: 2026-07-18T0409Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, ot-ics, rce, priv-esc, patch-available]
regions: [global, europe]
sectors: [energy, transport, water, manufacturing]
entities: []
techniques: [T1190, T1059.004, T1068, T1053.003]
affected_products: ["Siemens RUGGEDCOM ROX II"]
cves:
  - id: CVE-2025-40948
    cvss: "6.8"
    epss: null
    type: info-disclosure
    vector: zero-click
    auth: post-auth
    status: [patch-available]
    affected: "ROX II < V2.17.1 (MX5000, MX5000RE, RX1400/1500/1501/1510/1511/1512/1524/1536, RX5000)"
    fixed: "V2.17.1"
  - id: CVE-2025-40947
    cvss: "7.5"
    epss: null
    type: rce
    vector: zero-click
    auth: post-auth
    status: [patch-available]
    affected: "ROX II < V2.17.1"
    fixed: "V2.17.1"
  - id: CVE-2025-40949
    cvss: "9.1"
    epss: null
    type: rce
    vector: zero-click
    auth: post-auth
    status: [patch-available]
    affected: "ROX II < V2.17.1"
    fixed: "V2.17.1"
sources:
  - url: "https://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilities/"
    publisher: "Palo Alto Networks Unit 42"
    date: "2026-07-17"
    role: primary
  - url: "https://cert-portal.siemens.com/productcert/html/ssa-081142.html"
    publisher: "Siemens ProductCERT (SSA-081142)"
    date: "2026-05-12"
    role: corroborating
closed_sources: []
evidence:
  - quote: "Successful exploitation of this chain would allow an attacker to achieve full privilege escalation and persistent root-level access on these devices, which are critical components of industrial control networks."
    publisher: "Palo Alto Networks Unit 42"
  - quote: "Ruggedcom Rox contains an input validation vulnerability in the Scheduler functionality that could allow an authenticated remote attacker to execute arbitrary commands with root privileges on the underlying operating system."
    publisher: "Siemens ProductCERT (SSA-081142)"
verification: multi-source
sourcing_note: "Unit 42 (research lab, Admiralty B) published the chained analysis; Siemens ProductCERT (vendor for its own product, Admiralty A) independently confirms CVE-2025-40949 as an authenticated root command injection in the ROX II Scheduler. Siemens first published the advisories 2026-05-12; the in-window development is Unit 42's full-chain technical analysis of 2026-07-17."
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: B
  credibility: 1
watchlist_hit: false
actions: []
migrated_from: null
---

Unit 42 published a chained analysis (2026-07-17) of three vulnerabilities in Siemens RUGGEDCOM ROX II, the ruggedised OT switch/router family Siemens positions as a network-security boundary inside industrial networks — rail, utilities, water and manufacturing, including Swiss and European critical infrastructure ([Unit 42, 2026-07-17](https://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilities/)). The chain moves from information disclosure to persistent root. Stage one, **CVE-2025-40948** (CVSS 6.8), abuses a root-privileged daemon that invokes the `xz` utility with attacker-supplied parameters: supplying `-f`, `-c` and `-d` together turns `xz` into a `cat` equivalent, letting an attacker read any file on the device — configuration, password hashes, private keys ([Unit 42, 2026-07-17](https://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilities/)). Stage two, **CVE-2025-40947** (CVSS 7.5), is command injection in the feature-key signature-verification routine: the parsed signature string is inserted unsanitised into a `gpgv` command executed via `system()` as root, so a crafted feature-key file whose signature field carries a command-injection payload runs attacker code as root (typically after the attacker uploads a script through the web UI's normal feature-key upload). Stage three, **CVE-2025-40949** (CVSS 9.1), is command injection in the web-management task scheduler — Siemens describes it as an "authenticated remote attacker" injecting commands that "execute arbitrary commands with root privileges" ([Siemens ProductCERT SSA-081142, 2026-05-12](https://cert-portal.siemens.com/productcert/html/ssa-081142.html)) — writing malicious entries into the scheduler configuration for persistent, reboot-surviving root execution.

Siemens patched all three in firmware **V2.17.1** across the ROX II family (MX5000/MX5000RE, the RX1400–RX1536 line, RX5000) and published advisories SSA-973901, SSA-078743 and SSA-081142; no in-the-wild exploitation is reported. The transferable lesson beyond this device family, per Unit 42, is the anti-pattern: a device invoking a general-purpose CLI utility (here `xz`) as root inside its own validation logic is a recurring OT/embedded-appliance weakness worth hunting for elsewhere.

**Defender takeaway:** Schedule the V2.17.1 firmware update on ROX II estates; where an OT change window delays it, keep the ROX II web-management and feature-key-upload interfaces isolated from untrusted segments as the interim control. Detection concept, telemetry-class first: on devices exposing shell/audit telemetry, hunt for anomalous `xz` invocations combining the `-f`/`-c`/`-d` flags, feature-key upload activity outside maintenance windows, and unexpected entries appearing in the task-scheduler configuration (arbitrary interpreters such as `python`/`bash` or direct system calls in place of legitimate task functions). **Triage:** legitimate ROX II administration uses the scheduler for periodic maintenance tasks — the discriminator is a scheduled task whose command field invokes a general script interpreter or shell rather than the device's own task functions, especially one added outside a change window.