industrial-control-system-vulnerabilityembedded-device-vulnerabilitywidely-deployed-product-advisorycritical-infrastructure-threat

Critical Command Injection in Siemens RUGGEDCOM ROX Enables Root RCE

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen May 12, 2026

Siemens RUGGEDCOM ROX industrial networking devices contain a critical OS command injection flaw, tracked as CVE-2025-40949, in the Scheduler function of the Web UI. The vulnerability stems from improper input validation in the task scheduling backend, allowing an authenticated remote attacker to inject arbitrary commands and execute them with root privileges on the underlying operating system. The issue carries a CVSS v3.1 score of 9.1 and was reported by researchers at the Palo Alto Networks OT Threat Research Lab.

Affected products include multiple Siemens RUGGEDCOM ROX lines, including MX5000, MX5000RE, RX1400, RX1500-series, RX1536, and RX5000 devices running versions earlier than 2.17.1. CISA republished Siemens ProductCERT guidance urging organizations to upgrade to fixed releases, restrict network exposure, and follow Siemens industrial security recommendations to reduce the risk of exploitation in operational technology environments.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · May 12, 2026 – May 14, 2026

May 14, 20266mo ago
CISA republishes Siemens advisory for CVE-2025-40949
CISA republished a Siemens ProductCERT advisory for the critical Ruggedcom Rox command injection vulnerability, assigning attention to the issue affecting industrial networking devices. The advisory recommends upgrading, restricting network exposure, and following Siemens industrial security guidance.
May 12, 20266mo ago
Siemens releases Ruggedcom Rox version 2.17.1 to fix CVE-2025-40949
Siemens released updated Ruggedcom Rox software, including version 2.17.1, to address CVE-2025-40949 affecting multiple MX5000, RX1400, RX1500-series, RX1536, and RX5000 devices. The vulnerable versions are those earlier than 2.17.1.
May 12, 20266mo ago
Palo Alto Networks researchers report Ruggedcom Rox command injection flaw
Researchers from Palo Alto Networks OT Threat Research Lab reported an OS command injection vulnerability in the Scheduler functionality of Siemens Ruggedcom Rox devices. The flaw allows an authenticated remote attacker to inject commands via the Web UI task scheduling backend and execute arbitrary commands with root privileges.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Affected products

11 linked

Ruggedcom Rox Rx1524Ruggedcom Rox Mx5000Ruggedcom Rox Rx5000Ruggedcom Rox Mx5000reRuggedcom Rox Rx1510Ruggedcom Rox Rx1500Ruggedcom Rox Rx1536Ruggedcom Rox Rx1511Ruggedcom Rox Rx1501Ruggedcom Rox Rx1400+1 more

Organizations

1 linked

Siemens

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Cisa AdvisoriesAdvisories · May 14, 2026

Siemens Ruggedcom Rox | CISAOpen source ↗

Cvefeed High SeverityAdvisories · May 12, 2026

CVE-2025-40949 - RUGGEDCOM ROX Command Injection VulnerabilityOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Critical Command Injection in Siemens RUGGEDCOM ROX Enables Root RCE

How this story unfolded

CISA republishes Siemens advisory for CVE-2025-40949

Siemens releases Ruggedcom Rox version 2.17.1 to fix CVE-2025-40949

Palo Alto Networks researchers report Ruggedcom Rox command injection flaw

Related entities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Siemens SICAM 8 Flaws Expose OT Devices to Denial-of-Service

Critical Node-RED Authentication Bypass Enables Root RCE on Siemens SIMATIC IoT2050

Critical OT Flaws Expose Rockwell and WAGO Devices to Remote Compromise

Critical Command Injection in Siemens RUGGEDCOM ROX Enables Root RCE

How this story unfolded

CISA republishes Siemens advisory for CVE-2025-40949

Siemens releases Ruggedcom Rox version 2.17.1 to fix CVE-2025-40949

Palo Alto Networks researchers report Ruggedcom Rox command injection flaw

Related entities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Siemens SICAM 8 Flaws Expose OT Devices to Denial-of-Service

Critical Node-RED Authentication Bypass Enables Root RCE on Siemens SIMATIC IoT2050

Critical OT Flaws Expose Rockwell and WAGO Devices to Remote Compromise