cbcvebase.
CVE-2025-40948
published 2026-05-12

CVE-2025-40948: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEDCOM ROX RX1400…

PriorityP339medium6.8CVSS 3.1
AVNACLPRHUINSCCHINAN
EPSS
0.29%
20.6th percentile
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEDCOM ROX RX1400 (All versions < V2.17.1), RUGGEDCOM ROX RX1500 (All versions < V2.17.1), RUGGEDCOM ROX RX1501 (All versions < V2.17.1), RUGGEDCOM ROX RX1510 (All versions < V2.17.1), RUGGEDCOM ROX RX1511 (All versions < V2.17.1), RUGGEDCOM ROX RX1512 (All versions < V2.17.1), RUGGEDCOM ROX RX1524 (All versions < V2.17.1), RUGGEDCOM ROX RX1536 (All versions < V2.17.1), RUGGEDCOM ROX RX5000 (All versions < V2.17.1). Affected devices do not properly validate input in the web server's JSON-RPC interface. This could allow an authenticated remote attacker to read arbitrary files from the underlying operating system's filesystem with root privileges.

Affected

22 ranges
VendorProductVersion rangeFixed in
siemensruggedcom_rox_mx5000< V2.17.1V2.17.1
siemensruggedcom_rox_mx5000_firmware< 2.17.12.17.1
siemensruggedcom_rox_mx5000re< V2.17.1V2.17.1
siemensruggedcom_rox_mx5000re_firmware< 2.17.12.17.1
siemensruggedcom_rox_rx1400< V2.17.1V2.17.1
siemensruggedcom_rox_rx1400_firmware< 2.17.12.17.1
siemensruggedcom_rox_rx1500< V2.17.1V2.17.1
siemensruggedcom_rox_rx1500_firmware< 2.17.12.17.1
siemensruggedcom_rox_rx1501< V2.17.1V2.17.1
siemensruggedcom_rox_rx1501_firmware< 2.17.12.17.1
siemensruggedcom_rox_rx1510< V2.17.1V2.17.1
siemensruggedcom_rox_rx1510_firmware< 2.17.12.17.1
siemensruggedcom_rox_rx1511< V2.17.1V2.17.1
siemensruggedcom_rox_rx1511_firmware< 2.17.12.17.1
siemensruggedcom_rox_rx1512< V2.17.1V2.17.1
siemensruggedcom_rox_rx1512_firmware< 2.17.12.17.1
siemensruggedcom_rox_rx1524< V2.17.1V2.17.1
siemensruggedcom_rox_rx1524_firmware< 2.17.12.17.1
siemensruggedcom_rox_rx1536< V2.17.1V2.17.1
siemensruggedcom_rox_rx1536_firmware< 2.17.12.17.1
siemensruggedcom_rox_rx5000< V2.17.1V2.17.1
siemensruggedcom_rox_rx5000_firmware< 2.17.12.17.1

CVSS provenance

nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
nvdv4.06.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.