CVE-2025-33025
published 2025-05-13CVE-2025-33025: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400…
PriorityP272critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
1.17%
63.8th percentile
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (All versions < V2.16.5), RUGGEDCOM ROX RX1501 (All versions < V2.16.5), RUGGEDCOM ROX RX1510 (All versions < V2.16.5), RUGGEDCOM ROX RX1511 (All versions < V2.16.5), RUGGEDCOM ROX RX1512 (All versions < V2.16.5), RUGGEDCOM ROX RX1524 (All versions < V2.16.5), RUGGEDCOM ROX RX1536 (All versions < V2.16.5), RUGGEDCOM ROX RX5000 (All versions < V2.16.5). The 'traceroute' tool in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | ruggedcom_rox_mx5000 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_mx5000re | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1400 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1500 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1501 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1510 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1511 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1512 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1524 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx1536 | < V2.16.5 | V2.16.5 |
| siemens | ruggedcom_rox_rx5000 | < V2.16.5 | V2.16.5 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor web interface requests to the 'traceroute' tool on RUGGEDCOM ROX II devices for unsanitized input containing shell metacharacters or command injection payloads ↗
- →Alert on any process execution originating from the RUGGEDCOM ROX web interface that spawns unexpected child processes with root privileges, particularly from traceroute-related web handlers ↗
- ·Vulnerability requires an authenticated session with a highly privileged account; unauthenticated exploitation is not possible ↗
- ·No known public exploitation has been reported at time of advisory publication; detection should be treated as precautionary ↗
- ·All affected RUGGEDCOM ROX II product lines running versions prior to V2.16.5 are in scope; patched devices (V2.16.5+) are not affected ↗
CVSS provenance
nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv4.09.4CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens RUGGEDCOM ROX II
cisa_ics·2025-05-15
Siemens RUGGEDCOM ROX II
ICS Advisory
##
Siemens RUGGEDCOM ROX II
Release DateMay 15, 2025
Alert CodeICSA-25-135-17
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 9.4
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: RUGGEDCOM ROX II
- Vulnerabilities: Client-Side Enforcement of Server-Side Security
## 2. RISK EVALUATION
Successful exploitation of th
GHSA
GHSA-qchf-893f-x2hx: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2
ghsa_unreviewed·2025-05-13
CVE-2025-33025 [CRITICAL] CWE-602 GHSA-qchf-893f-x2hx: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (All versions < V2.16.5), RUGGEDCOM ROX RX1501 (All versions < V2.16.5), RUGGEDCOM ROX RX1510 (All versions < V2.16.5), RUGGEDCOM ROX RX1511 (All versions < V2.16.5), RUGGEDCOM ROX RX1512 (All versions < V2.16.5), RUGGEDCOM ROX RX1524 (All versions < V2.16.5), RUGGEDCOM ROX RX1536 (All versions < V2.16.5), RUGGEDCOM ROX RX5000 (All versions < V2.16.5). The 'traceroute' tool in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-05-13
Published