CVE-2025-33024
published 2025-05-13CVE-2025-33024: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400…
PriorityP272critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
1.17%
63.7th percentile
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (All versions < V2.16.5), RUGGEDCOM ROX RX1501 (All versions < V2.16.5), RUGGEDCOM ROX RX1510 (All versions < V2.16.5), RUGGEDCOM ROX RX1511 (All versions < V2.16.5), RUGGEDCOM ROX RX1512 (All versions < V2.16.5), RUGGEDCOM ROX RX1524 (All versions < V2.16.5), RUGGEDCOM ROX RX1536 (All versions < V2.16.5), RUGGEDCOM ROX RX5000 (All versions < V2.16.5). The 'tcpdump' tool in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | ruggedcom_rox_mx5000 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_mx5000re | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1400 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1500 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1501 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1510 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1511 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1512 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1524 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1536 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx5000 | < V2.16.5 | V2.16.5 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor web interface requests to the 'tcpdump' tool on RUGGEDCOM ROX II devices for unsanitized/injected command characters in input parameters, which may indicate command injection attempts targeting root-level code execution. ↗
- →Alert on authenticated remote sessions interacting with the tcpdump web interface feature on RUGGEDCOM ROX II devices running firmware versions prior to V2.16.5, especially those originating from unexpected source IPs or exhibiting shell metacharacters in parameters. ↗
- ·Exploitation requires an authenticated session with a legitimate, highly privileged account on the web interface; unauthenticated exploitation is not indicated. ↗
- ·All RUGGEDCOM ROX II product variants are affected across all firmware versions prior to V2.16.5; the vulnerability is present in the web interface's tcpdump tool due to missing server-side input sanitization. ↗
- ·No known public exploitation specifically targeting this vulnerability has been reported at the time of advisory publication. ↗
CVSS provenance
nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv4.09.4CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens RUGGEDCOM ROX II
cisa_ics·2025-05-15
Siemens RUGGEDCOM ROX II
ICS Advisory
##
Siemens RUGGEDCOM ROX II
Release DateMay 15, 2025
Alert CodeICSA-25-135-17
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 9.4
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: RUGGEDCOM ROX II
- Vulnerabilities: Client-Side Enforcement of Server-Side Security
## 2. RISK EVALUATION
Successful exploitation of th
GHSA
GHSA-x6hg-98ph-g733: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2
ghsa_unreviewed·2025-05-13
CVE-2025-33024 [CRITICAL] CWE-602 GHSA-x6hg-98ph-g733: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (All versions < V2.16.5), RUGGEDCOM ROX RX1501 (All versions < V2.16.5), RUGGEDCOM ROX RX1510 (All versions < V2.16.5), RUGGEDCOM ROX RX1511 (All versions < V2.16.5), RUGGEDCOM ROX RX1512 (All versions < V2.16.5), RUGGEDCOM ROX RX1524 (All versions < V2.16.5), RUGGEDCOM ROX RX1536 (All versions < V2.16.5), RUGGEDCOM ROX RX5000 (All versions < V2.16.5). The 'tcpdump' tool in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-05-13
Published