CVE-2025-32469
published 2025-05-13CVE-2025-32469: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400…
PriorityP272critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
1.21%
64.9th percentile
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (All versions < V2.16.5), RUGGEDCOM ROX RX1501 (All versions < V2.16.5), RUGGEDCOM ROX RX1510 (All versions < V2.16.5), RUGGEDCOM ROX RX1511 (All versions < V2.16.5), RUGGEDCOM ROX RX1512 (All versions < V2.16.5), RUGGEDCOM ROX RX1524 (All versions < V2.16.5), RUGGEDCOM ROX RX1536 (All versions < V2.16.5), RUGGEDCOM ROX RX5000 (All versions < V2.16.5). The 'ping' tool in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | ruggedcom_rox_mx5000 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_mx5000re | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1400 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1500 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1501 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1510 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1511 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1512 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1524 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1536 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx5000 | < V2.16.5 | V2.16.5 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor web interface requests to the 'ping' tool on RUGGEDCOM ROX II devices for unsanitized input containing shell metacharacters or command injection payloads, which could indicate exploitation of CVE-2025-32469. ↗
- →Alert on any process execution originating from the RUGGEDCOM ROX II web interface process that spawns unexpected child processes (e.g., shells or OS commands), as successful exploitation results in arbitrary code execution with root privileges. ↗
- →The vulnerability is exploitable remotely with low attack complexity and only requires low privileges (authenticated user); monitor for authenticated low-privileged web interface sessions issuing diagnostic tool requests with anomalous parameters. ↗
- ·Exploitation requires an authenticated session on the web interface; unauthenticated attackers cannot directly exploit this vulnerability. Ensure web interface access is restricted to trusted, highly privileged accounts only. ↗
- ·All RUGGEDCOM ROX II product lines running versions prior to V2.16.5 are affected; detection rules should target these specific firmware versions. ↗
- ·No known public exploitation has been reported at the time of advisory publication; detection posture should be proactive rather than reactive. ↗
- ·The input sanitization is missing on the server side only; client-side controls (CWE-602) may appear to block malicious input but can be trivially bypassed, so network-level inspection of HTTP requests to the ping endpoint is necessary. ↗
CVSS provenance
nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv4.09.4CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens RUGGEDCOM ROX II
cisa_ics·2025-05-15
Siemens RUGGEDCOM ROX II
ICS Advisory
##
Siemens RUGGEDCOM ROX II
Release DateMay 15, 2025
Alert CodeICSA-25-135-17
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 9.4
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: RUGGEDCOM ROX II
- Vulnerabilities: Client-Side Enforcement of Server-Side Security
## 2. RISK EVALUATION
Successful exploitation of th
GHSA
GHSA-w4g2-c8px-8c79: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2
ghsa_unreviewed·2025-05-13
CVE-2025-32469 [CRITICAL] CWE-602 GHSA-w4g2-c8px-8c79: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (All versions < V2.16.5), RUGGEDCOM ROX RX1501 (All versions < V2.16.5), RUGGEDCOM ROX RX1510 (All versions < V2.16.5), RUGGEDCOM ROX RX1511 (All versions < V2.16.5), RUGGEDCOM ROX RX1512 (All versions < V2.16.5), RUGGEDCOM ROX RX1524 (All versions < V2.16.5), RUGGEDCOM ROX RX1536 (All versions < V2.16.5), RUGGEDCOM ROX RX5000 (All versions < V2.16.5). The 'ping' tool in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-05-13
Published