CVE-2025-40949

CVE Enrichment

CVSS: 8.9 HIGH
EPSS: 0.67%
EPSS Percentile: 51.89%
CISA KEV: Not listed

Description

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEDCOM ROX RX1400 (All versions < V2.17.1), RUGGEDCOM ROX RX1500 (All versions < V2.17.1), RUGGEDCOM ROX RX1501 (All versions < V2.17.1), RUGGEDCOM ROX RX1510 (All versions < V2.17.1), RUGGEDCOM ROX RX1511 (All versions < V2.17.1), RUGGEDCOM ROX RX1512 (All versions < V2.17.1), RUGGEDCOM ROX RX1524 (All versions < V2.17.1), RUGGEDCOM ROX RX1536 (All versions < V2.17.1), RUGGEDCOM ROX RX5000 (All versions < V2.17.1). Affected devices do not properly sanitize user-supplied input in the Scheduler functionality of the Web UI, allowing commands to be injected into the task scheduling backend. This could allow an authenticated remote attacker to execute arbitrary commands with root privileges on the underlying operating system.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 12-May-2026 17:16
Last Modified: 24-Oct-2026 05:10
EPSS Date: 2026-10-26
CWE: CWE-78

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:P /
                            PR:H /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:H /
                            SI:H /
                            SA:H /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

Affected Products / Versions

siemens / ruggedcom_rox_mx5000_firmware
Version / affected range: * · before (exclusive) 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_mx5000_firmware:*:*:*:*:*:*:*:*
siemens / ruggedcom_rox_mx5000re_firmware
Version / affected range: * · before (exclusive) 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_mx5000re_firmware:*:*:*:*:*:*:*:*
siemens / ruggedcom_rox_rx1400_firmware
Version / affected range: * · before (exclusive) 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1400_firmware:*:*:*:*:*:*:*:*
siemens / ruggedcom_rox_rx1500_firmware
Version / affected range: * · before (exclusive) 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1500_firmware:*:*:*:*:*:*:*:*
siemens / ruggedcom_rox_rx1501_firmware
Version / affected range: * · before (exclusive) 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1501_firmware:*:*:*:*:*:*:*:*
siemens / ruggedcom_rox_rx1510_firmware
Version / affected range: * · before (exclusive) 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1510_firmware:*:*:*:*:*:*:*:*
siemens / ruggedcom_rox_rx1511_firmware
Version / affected range: * · before (exclusive) 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1511_firmware:*:*:*:*:*:*:*:*
siemens / ruggedcom_rox_rx1512_firmware
Version / affected range: * · before (exclusive) 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1512_firmware:*:*:*:*:*:*:*:*
siemens / ruggedcom_rox_rx1524_firmware
Version / affected range: * · through (inclusive) 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1524_firmware:*:*:*:*:*:*:*:*
siemens / ruggedcom_rox_rx1536_firmware
Version / affected range: * · before (exclusive) 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1536_firmware:*:*:*:*:*:*:*:*
siemens / ruggedcom_rox_rx5000_firmware
Version / affected range: * · before (exclusive) 2.17.1
cpe:2.3:o:siemens:ruggedcom_rox_rx5000_firmware:*:*:*:*:*:*:*:*

References

[email protected]

Last enrichment sync: 27-Oct-2026 09:43
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

The compromise is then cemented using a third vulnerability (CVE-2025-40949) in the web management task scheduler, allowing malicious code execution to survive system reboots. Cybersecurity Roundup: Dolphin X Malware, Linux CVEs and Vehicle Security Flaw

CVE (3)

Malware (1)

Threat Actors (4)

Vendors (4)

Products (4)

Tools (1)

Industries (3)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.