Siemens RUGGEDCOM ROX MX5000

CVE-2025-40949

HIGH 8.9

En bref

Source: NVD
EPSS: EPSS 0.67 % · centile 52 (2026-10-31)
État: PUBLISHED
Publiée: 2026-05-12 08:20 UTC
Mise à jour: 2026-05-13 09:53 UTC
Attribuée par: siemens
Statut NVD: Analyzed

Rechercher sur…

Description

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEDCOM ROX RX1400 (All versions < V2.17.1), RUGGEDCOM ROX RX1500 (All versions < V2.17.1), RUGGEDCOM ROX RX1501 (All versions < V2.17.1), RUGGEDCOM ROX RX1510 (All versions < V2.17.1), RUGGEDCOM ROX RX1511 (All versions < V2.17.1), RUGGEDCOM ROX RX1512 (All versions < V2.17.1), RUGGEDCOM ROX RX1524 (All versions < V2.17.1), RUGGEDCOM ROX RX1536 (All versions < V2.17.1), RUGGEDCOM ROX RX5000 (All versions < V2.17.1). Affected devices do not properly sanitize user-supplied input in the Scheduler functionality of the Web UI, allowing commands to be injected into the task scheduling backend. This could allow an authenticated remote attacker to execute arbitrary commands with root privileges on the underlying operating system.

Faiblesses (CWE)

CWE-78 — Injection de commande système

Références

https://cert-portal.siemens.com/productcert/html/ssa-081142.html

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	CRITICAL 9.1	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	siemens
CVSS 4.0	HIGH 8.9	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	siemens
CVSS 4.0	HIGH 8.9	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · productcert@siemens.com (Secondary)
CVSS 3.1	CRITICAL 9.1	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	NVD · productcert@siemens.com (Secondary)

Références européennes

ENISA EUVD · EUVD-2025-209782
GCVE · GCVE-0-2025-40949

Configurations affectées (CPE NVD)

cpe:2.3:o:siemens:ruggedcom_rox_mx5000_firmware:*:*:*:*:*:*:*:* < 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_mx5000re_firmware:*:*:*:*:*:*:*:* < 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1400_firmware:*:*:*:*:*:*:*:* < 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1500_firmware:*:*:*:*:*:*:*:* < 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1501_firmware:*:*:*:*:*:*:*:* < 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1510_firmware:*:*:*:*:*:*:*:* < 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1511_firmware:*:*:*:*:*:*:*:* < 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1512_firmware:*:*:*:*:*:*:*:* < 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1524_firmware:*:*:*:*:*:*:*:* ≤ 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1536_firmware:*:*:*:*:*:*:*:* < 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx5000_firmware:*:*:*:*:*:*:*:* < 2.17.1

Produits affectés

Produit	Versions
Siemens · RUGGEDCOM ROX MX5000	affected 0 < V2.17.1
Siemens · RUGGEDCOM ROX MX5000RE	affected 0 < V2.17.1
Siemens · RUGGEDCOM ROX RX1400	affected 0 < V2.17.1
Siemens · RUGGEDCOM ROX RX1500	affected 0 < V2.17.1
Siemens · RUGGEDCOM ROX RX1501	affected 0 < V2.17.1
Siemens · RUGGEDCOM ROX RX1510	affected 0 < V2.17.1
Siemens · RUGGEDCOM ROX RX1511	affected 0 < V2.17.1
Siemens · RUGGEDCOM ROX RX1512	affected 0 < V2.17.1
Siemens · RUGGEDCOM ROX RX1524	affected 0 < V2.17.1
Siemens · RUGGEDCOM ROX RX1536	affected 0 < V2.17.1
Siemens · RUGGEDCOM ROX RX5000	affected 0 < V2.17.1

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Siemens RUGGEDCOM ROX MX5000