Security Intelligence
Loading table of contents...
At a glance:
-
Researchers released proof-of-concept exploit code showing how three Siemens Ruggedcom ROX II vulnerabilities can be chained to move from authenticated access to full device compromise.
-
The findings show that an adversary can extract sensitive system data, gain root privileges and establish persistence on a core OT switching platform, putting industrial network integrity and availability at risk.
-
Siemens has issued patches and mitigation guidance, making immediate firmware updates and strict management-interface controls critical for defenders.
Threat summary
On July 17, 2026, researchers from Unit 42 published proof-of-concept exploit code for three vulnerabilities in Siemens Ruggedcom ROX II, the operating system used in Siemens industrial switches that provide routing, segmentation and secure access for operational technology (OT) networks.
Siemens patched all three flaws, tracked as CVE-2025-40948, CVE-2025-40947 and CVE-2025-40949, on May 12, 2026 with firmware V2.17.1.
The PoC illustrates how an adversary can progress from limited, authenticated access to full and persistent control of a ROX II device:
- CVE‑2025‑40949 allows an authenticated threat actor to execute commands with elevated privileges due to improper input validation in the task scheduler. This enables an adversary with administrative access to inject commands that run with root privileges and persist across reboots. Siemens rates the issue Critical with a CVSS v3.1 score of 9.1.
- CVE‑2025‑40948 allows an authenticated threat actor with access to the upload interface to cause a privileged process to pass user‑controlled input to the xz utility, revealing files stored on the device. Siemens rates the issue Medium severity with a CVSS score of 6.8.
- CVE‑2025‑40947 allows an authenticated threat actor to inject commands into a privileged verification process within the feature‑key interface, resulting in root‑level execution. Siemens rates the issue High severity with a CVSS v3.1 score of 7.5.
By first extracting sensitive system data, such as configuration files, credential material and internal paths, the adversary gains the insight needed to craft a targeted payload that triggers root-level command execution.
After achieving root access, the adversary establishes long-term persistence by injecting malicious entries into the scheduler’s configuration, causing the device to repeatedly execute attacker-controlled commands with full privileges.
This results in sustained control over the switch and enables high-impact actions including data exfiltration, manipulation of industrial network traffic and disruption of critical services.
Insights & mitigations
The vulnerabilities collectively undermine the core security functions of Siemens Ruggedcom ROX II, turning a device meant to enforce segmentation and stability into an entry point for deep network compromise. Because OT switches sit at the center of industrial communication, linking HMIs, PLCs and safety systems, any loss of integrity or availability directly affects the reliability of the entire operational environment.
Successful exploitation effectively converts the switch into a long‑term foothold inside the OT network. With this level of access, an adversary could manipulate traffic flows, disable segmentation boundaries, intercept or alter commands between critical assets, or disrupt process operations.
The misconception that OT networks are inherently safe due to isolation increases the risk: once a threat actor reaches the management interface, these software flaws provide a clear path to privilege escalation and operational disruption. In environments such as manufacturing plants or power generation facilities, this could lead to production outages, safety system interference or broader impacts on industrial processes.
Apply Siemens firmware version V2.17.1 across all Ruggedcom ROX II devices. Restrict access to administrative interfaces, including feature key installation, task scheduling and file upload functions. Monitor for unexpected scheduled tasks, anomalous configuration changes and unusual invocation of the xz utility. Validate segmentation policies to limit the threat of a compromised switch.
Where patch deployment requires staged rollout, consider compensating controls such as enforcing strong authentication, limiting access to management networks and increasing monitoring of device configuration events.
Stay on top of emerging threats like this.
Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities.
.jpg)