CVE-2025-40948

CVE Enrichment

CVSS: 6.1 MEDIUM
EPSS: 0.40%
EPSS Percentile: 33.69%
CISA KEV: Not listed

Description

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEDCOM ROX RX1400 (All versions < V2.17.1), RUGGEDCOM ROX RX1500 (All versions < V2.17.1), RUGGEDCOM ROX RX1501 (All versions < V2.17.1), RUGGEDCOM ROX RX1510 (All versions < V2.17.1), RUGGEDCOM ROX RX1511 (All versions < V2.17.1), RUGGEDCOM ROX RX1512 (All versions < V2.17.1), RUGGEDCOM ROX RX1524 (All versions < V2.17.1), RUGGEDCOM ROX RX1536 (All versions < V2.17.1), RUGGEDCOM ROX RX5000 (All versions < V2.17.1). Affected devices do not properly validate input in the web server's JSON-RPC interface. This could allow an authenticated remote attacker to read arbitrary files from the underlying operating system's filesystem with root privileges.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 12-May-2026 17:16
Last Modified: 24-Oct-2026 05:10
EPSS Date: 2026-10-26
CWE: CWE-88

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:H /
                            UI:N /
                            VC:N /
                            VI:N /
                            VA:N /
                            SC:H /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

Affected Products / Versions

siemens / ruggedcom_rox_mx5000_firmware
Version / affected range: * · before (exclusive) 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_mx5000_firmware:*:*:*:*:*:*:*:*
siemens / ruggedcom_rox_mx5000re_firmware
Version / affected range: * · before (exclusive) 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_mx5000re_firmware:*:*:*:*:*:*:*:*
siemens / ruggedcom_rox_rx1400_firmware
Version / affected range: * · before (exclusive) 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1400_firmware:*:*:*:*:*:*:*:*
siemens / ruggedcom_rox_rx1500_firmware
Version / affected range: * · before (exclusive) 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1500_firmware:*:*:*:*:*:*:*:*
siemens / ruggedcom_rox_rx1501_firmware
Version / affected range: * · before (exclusive) 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1501_firmware:*:*:*:*:*:*:*:*
siemens / ruggedcom_rox_rx1510_firmware
Version / affected range: * · before (exclusive) 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1510_firmware:*:*:*:*:*:*:*:*
siemens / ruggedcom_rox_rx1511_firmware
Version / affected range: * · before (exclusive) 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1511_firmware:*:*:*:*:*:*:*:*
siemens / ruggedcom_rox_rx1512_firmware
Version / affected range: * · before (exclusive) 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1512_firmware:*:*:*:*:*:*:*:*
siemens / ruggedcom_rox_rx1524_firmware
Version / affected range: * · before (exclusive) 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1524_firmware:*:*:*:*:*:*:*:*
siemens / ruggedcom_rox_rx1536_firmware
Version / affected range: * · before (exclusive) 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1536_firmware:*:*:*:*:*:*:*:*
siemens / ruggedcom_rox_rx5000_firmware
Version / affected range: * · before (exclusive) 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx5000_firmware:*:*:*:*:*:*:*:*

References

[email protected]

Last enrichment sync: 27-Oct-2026 09:37
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

By exploiting an arbitrary file disclosure flaw (CVE-2025-40948), an attacker can gather sensitive system intelligence to facilitate a subsequent privilege escalation via command injection (CVE-2025-40947). Cybersecurity Roundup: Dolphin X Malware, Linux CVEs and Vehicle Security Flaw

CVE (3)

Malware (1)

Threat Actors (4)

Vendors (4)

Products (4)

Tools (1)

Industries (3)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.