6.8

CVE-2025-40948

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEDCOM ROX RX1400 (All versions < V2.17.1), RUGGEDCOM ROX RX1500 (All versions < V2.17.1), RUGGEDCOM ROX RX1501 (All versions < V2.17.1), RUGGEDCOM ROX RX1510 (All versions < V2.17.1), RUGGEDCOM ROX RX1511 (All versions < V2.17.1), RUGGEDCOM ROX RX1512 (All versions < V2.17.1), RUGGEDCOM ROX RX1524 (All versions < V2.17.1), RUGGEDCOM ROX RX1536 (All versions < V2.17.1), RUGGEDCOM ROX RX5000 (All versions < V2.17.1). Affected devices do not properly validate input in the web server's JSON-RPC interface.

This could allow an authenticated remote attacker to read arbitrary files from the underlying operating system's filesystem with root privileges.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Siemens ≫ Ruggedcom Rox Mx5000 Firmware Version < 2.17.1
   Siemens ≫ Ruggedcom Rox Mx5000 Version-
Siemens ≫ Ruggedcom Rox Rx1400 Firmware Version < 2.17.1
   Siemens ≫ Ruggedcom Rox Rx1400 Version-
Siemens ≫ Ruggedcom Rox Rx1500 Firmware Version < 2.17.1
   Siemens ≫ Ruggedcom Rox Rx1500 Version-
Siemens ≫ Ruggedcom Rox Rx1501 Firmware Version < 2.17.1
   Siemens ≫ Ruggedcom Rox Rx1501 Version-
Siemens ≫ Ruggedcom Rox Rx1510 Firmware Version < 2.17.1
   Siemens ≫ Ruggedcom Rox Rx1510 Version-
Siemens ≫ Ruggedcom Rox Rx1511 Firmware Version < 2.17.1
   Siemens ≫ Ruggedcom Rox Rx1511 Version-
Siemens ≫ Ruggedcom Rox Rx1512 Firmware Version < 2.17.1
   Siemens ≫ Ruggedcom Rox Rx1512 Version-
Siemens ≫ Ruggedcom Rox Rx1524 Firmware Version < 2.17.1
   Siemens ≫ Ruggedcom Rox Rx1524 Version-
Siemens ≫ Ruggedcom Rox Rx1536 Firmware Version < 2.17.1
   Siemens ≫ Ruggedcom Rox Rx1536 Version-
Siemens ≫ Ruggedcom Rox Rx5000 Firmware Version < 2.17.1
   Siemens ≫ Ruggedcom Rox Rx5000 Version-
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.29% 0.201
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
productcert@siemens.com 6.1 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
productcert@siemens.com 6.8 2.3 4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

https://cert-portal.siemens.com/productcert/html/ssa-973901.html
Vendor Advisory
Mitigation