A vulnerability has been identified in RUGGEDCOM ROX MX5000

CVE-2025-40949 is a CWE-78 OS command injection in the Scheduler feature of the RUGGEDCOM ROX II web management UI. An authenticated user with high privilege (PR:H) can inject control characters into the task-scheduling configuration file; the injected payload is then executed by root via the system cron/scheduler daemon, giving persistent root shell that survives reboot. Affected: RUGGEDCOM ROX MX5000/MX5000RE, RX1400/1500/1501/1510/1511/1512/1524/1536, and RX5000, all versions < V2.17.1. Fixed in V2.17.1.

The vendor rates this 9.1 Critical because of S:C/C:H/I:H/A:H — root code execution on an OT edge device is genuinely severe. But the vector is honest: PR:H means the attacker already has a privileged UI credential. On a hardened, air-gapped substation router with per-role RBAC, that's a very high bar. The Critical label overstates real-world exposure for the population of *properly deployed* ROX units; a High rating fits better, and once you factor in typical ICS deployment posture (management plane on a segregated network, not internet-reachable) the practical severity slides into Medium territory. This is part of the Palo Alto Unit 42 ROX II trilogy (CVE-2025-40947/40948/40949) — the interesting story is the *chain*, not this single bug.

Why this verdict

• PR:H is a hard gate. The vendor's 9.1 already discounts UI, but on ROX admin RBAC is held by a small OT engineering group; harvesting one requires an upstream compromise that itself is high-effort.
• Management-plane exposure is near-zero externally. Canonical Siemens ROX deployments live on isolated OT/engineering VLANs per IEC-62443. Internet-facing units are a rounding error in the installed base.
• No KEV, no PoC, EPSS 0.5%. The chain is documented but not weaponized publicly, and OT actors that would care (Volt Typhoon, Sandworm) prefer credential-theft paths that don't need this bug.
• Role multiplier: RUGGEDCOM ROX is a substation/rail/utility edge router — high-value role by definition. A successful chain gives root on an OT L2/L3 device with pivot potential to PLCs and IEDs. That role multiplier prevents downgrade below MEDIUM and is why we don't sink this to LOW despite the friction. If the affected device sits at a Purdue L3/L3.5 boundary in a utility, treat as HIGH locally.
• Chained context matters. If paired with CVE-2025-40947 (lower PR) and 40948, the effective PR drops. If your ROX fleet is unpatched for the whole trio, treat the trio as HIGH.

Why not higher?

Vendor scored 9.1 assuming worst-case attacker position, but PR:H is real and OT management planes aren't internet-reachable in any competent deployment. There is no public PoC, no KEV listing, no observed exploitation, and EPSS is 0.5%. Rating this HIGH universally would misallocate limited OT-patching windows.

Why not lower?

Root RCE on an OT edge router that terminates process-control traffic is not a LOW — the blast radius touches safety-adjacent systems and the RUGGEDCOM ROX role is canonically high-value. The Purdue-L3 role multiplier floors this at MEDIUM and pushes to HIGH for utility/rail operators.

1. Restrict ROX WebUI to a jump host ACL — Enforce management-plane isolation with an explicit allow-list of engineering jump hosts on the ROX firewall/ACL config. This kills step 1 of the chain entirely. Deploy within the noisgate mitigation SLA window — no SLA required for MEDIUM, but do this alongside your next OT change window.
2. Rotate all ROX admin credentials and enforce TACACS+/RADIUS with MFA — PR:H is the whole ballgame. If admin auth goes through your central AAA with MFA, harvested static passwords become useless. Do this within 30 days regardless of this CVE.
3. Enable syslog forwarding of ROX WebUI auth + config-change events to SIEM — Pre-patch you have no on-box detection for the injection itself, but you *can* detect the admin login and the Scheduler config change. Create SIEM alerts on scheduler config diffs on ROX devices.
4. Schedule V2.17.1 firmware upgrade in next OT maintenance window — Vendor patch is the actual fix. Coordinate with process-owners; ROX reboots take the port down. Target within the noisgate remediation SLA window of ≤ 365 days for MEDIUM — but if you're a utility with Purdue-L3 deployment, treat as HIGH and hit ≤ 180 days.
5. Block egress from OT management VLAN to internet — The injected root shell needs to call home. A deny-by-default egress rule from the ROX management interface makes the payload land but not phone out, degrading the post-exploit value.

Run from an auditor workstation with network access to your ROX device management IPs and valid read-only credentials. Invoke as python3 rox_check.py 10.10.20.5 auditor 'password' — the script queries the ROX device version and compares against the V2.17.1 fixed baseline. Requires Python 3.8+ and the requests library.

#!/usr/bin/env python3
# noisgate: CVE-2025-40949 RUGGEDCOM ROX version check
# Usage: python3 rox_check.py <host> <user> <password>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
import sys, re, urllib3
try:
    import requests
except ImportError:
    print('UNKNOWN: install requests -> pip install requests')
    sys.exit(2)

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

FIXED = (2, 17, 1)

def parse_ver(s):
    m = re.search(r'V?(\d+)\.(\d+)\.(\d+)', s)
    return tuple(int(x) for x in m.groups()) if m else None

def main():
    if len(sys.argv) != 4:
        print('Usage: rox_check.py <host> <user> <password>')
        sys.exit(2)
    host, user, pw = sys.argv[1], sys.argv[2], sys.argv[3]
    base = f'https://{host}'
    s = requests.Session()
    s.verify = False
    s.auth = (user, pw)
    try:
        # ROX exposes system info via the NETCONF-over-HTTP or the WebUI system page
        r = s.get(f'{base}/rest/running/admin/system-info', timeout=10)
        if r.status_code == 401:
            print('UNKNOWN: auth failed')
            sys.exit(2)
        ver = parse_ver(r.text)
        if not ver:
            # fallback: scrape WebUI login banner
            r2 = s.get(f'{base}/', timeout=10)
            ver = parse_ver(r2.text)
        if not ver:
            print('UNKNOWN: could not identify ROX version')
            sys.exit(2)
        print(f'Detected ROX version: {".".join(map(str,ver))}')
        if ver >= FIXED:
            print('PATCHED')
            sys.exit(0)
        print('VULNERABLE: upgrade to V2.17.1 or later (CVE-2025-40949)')
        sys.exit(1)
    except requests.RequestException as e:
        print(f'UNKNOWN: {e}')
        sys.exit(2)

if __name__ == '__main__':
    main()

Sources

1. Siemens ProductCERT SSA-599506
2. CISA ICSA-26-134-12 — Siemens RUGGEDCOM ROX
3. Unit 42: Three Steps to the Terminal — Siemens ROX II Zero-Day Trilogy
4. RMC Global — Siemens ROXOS II RCE Attack Chain
5. ISSSource — Siemens Fixes RUGGEDCOM ROX Hole
6. OpenCVE — RUGGEDCOM ROX MX5000 CVE listing
7. Windows News — CVE-2025-40947 companion writeup