CVE-2025-40948
published 2026-05-12CVE-2025-40948: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEDCOM ROX RX1400…
PriorityP340medium6.8CVSS 3.1
AVNACLPRHUINSCCHINAN
EPSS
0.40%
32.8th percentile
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEDCOM ROX RX1400 (All versions < V2.17.1), RUGGEDCOM ROX RX1500 (All versions < V2.17.1), RUGGEDCOM ROX RX1501 (All versions < V2.17.1), RUGGEDCOM ROX RX1510 (All versions < V2.17.1), RUGGEDCOM ROX RX1511 (All versions < V2.17.1), RUGGEDCOM ROX RX1512 (All versions < V2.17.1), RUGGEDCOM ROX RX1524 (All versions < V2.17.1), RUGGEDCOM ROX RX1536 (All versions < V2.17.1), RUGGEDCOM ROX RX5000 (All versions < V2.17.1). Affected devices do not properly validate input in the web server's JSON-RPC interface.
This could allow an authenticated remote attacker to read arbitrary files from the underlying operating system's filesystem with root privileges.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | ruggedcom_rox_mx5000 | < V2.17.1 | V2.17.1 |
| siemens | ruggedcom_rox_mx5000_firmware | < 2.17.1 | 2.17.1 |
| siemens | ruggedcom_rox_mx5000re | < V2.17.1 | V2.17.1 |
| siemens | ruggedcom_rox_mx5000re_firmware | < 2.17.1 | 2.17.1 |
| siemens | ruggedcom_rox_rx1400 | < V2.17.1 | V2.17.1 |
| siemens | ruggedcom_rox_rx1400_firmware | < 2.17.1 | 2.17.1 |
| siemens | ruggedcom_rox_rx1500 | < V2.17.1 | V2.17.1 |
| siemens | ruggedcom_rox_rx1500_firmware | < 2.17.1 | 2.17.1 |
| siemens | ruggedcom_rox_rx1501 | < V2.17.1 | V2.17.1 |
| siemens | ruggedcom_rox_rx1501_firmware | < 2.17.1 | 2.17.1 |
| siemens | ruggedcom_rox_rx1510 | < V2.17.1 | V2.17.1 |
| siemens | ruggedcom_rox_rx1510_firmware | < 2.17.1 | 2.17.1 |
| siemens | ruggedcom_rox_rx1511 | < V2.17.1 | V2.17.1 |
| siemens | ruggedcom_rox_rx1511_firmware | < 2.17.1 | 2.17.1 |
| siemens | ruggedcom_rox_rx1512 | < V2.17.1 | V2.17.1 |
| siemens | ruggedcom_rox_rx1512_firmware | < 2.17.1 | 2.17.1 |
| siemens | ruggedcom_rox_rx1524 | < V2.17.1 | V2.17.1 |
| siemens | ruggedcom_rox_rx1524_firmware | < 2.17.1 | 2.17.1 |
| siemens | ruggedcom_rox_rx1536 | < V2.17.1 | V2.17.1 |
| siemens | ruggedcom_rox_rx1536_firmware | < 2.17.1 | 2.17.1 |
| siemens | ruggedcom_rox_rx5000 | < V2.17.1 | V2.17.1 |
| siemens | ruggedcom_rox_rx5000_firmware | < 2.17.1 | 2.17.1 |
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
nvdv4.06.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Unit42
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
blogs_unit42·2026-10-21
CVE-2026-109618 Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
## Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
Unit 42
Published: October 21, 2026
High Profile Threats
Vulnerabilities
CVE-2026-109618
CVE-2026-109619
## Executive Summary
Unit 42 is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. Both are remote code execution (RCE) vulnerabilities rated as 9.2 (CVSS 4.0). We encourage reviewing the PHP Group’s security advisory and patching guidance .
PHP is widely used across web servers and content management systems globally. We recommend assessing your exposure to these vulnerabilities and patching immediately.
Unit 42 has seen proof of concept of these vulnerabilities. At least one European government has taken its website offline as a precaution.
Palo Alto Network
Unit42
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
blogs_unit42·2026-09-28·CVSS 9.8
CVE-2026-88771 [CRITICAL] Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
## Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
Unit 42
Published: September 28, 2026
High Profile Threats
Vulnerabilities
Citrix Netscaler
Denial of service
Remote Code Execution
Zero-day
## Executive Summary
Unit 42 is aware of possible zero-day activity against NetScaler devices. Citrix reports that CVE-2026-88771 and CVE-2026-88772 have been exploited in the wild. As of Sept. 27, 2026, Palo Alto Networks Cortex Xpanse has identified 50,277 exposed instances that could potentially be vulnerable to these CVEs based on our telemetry.
CVE-2026-88771 is a remote code execution (RCE) vulnerability that fails to properly validate input and allows an unauthenticated actor to run commands against NetScaler ADC and NetScaler Gateway syst
Unit42
The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software
blogs_unit42·2026-08-04
CVE-2025-40947 The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software
## The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software
Xu Zou
Published: August 4, 2026
General
Insights
Vulnerabilities
AI
Frontier AI
Vulnerability Exploitation
Zero-day
## Executive Summary
Frontier AI is fundamentally shifting the dynamics of cybersecurity — accelerating both how vulnerabilities are discovered and how quickly they can be exploited.
Our vulnerability research team built an autonomous vulnerability discovery, validation and reporting system that we call Network and Open-Source Vulnerability Analyzer (NOVA), an agentic research system that leverages proprietary AI harnesses powered by multiple leading frontier AI models. Our goal with this research is twofold: (1) contribute to improving the security of
Unit42
Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks
blogs_unit42·2026-07-30
CVE-2026-33017 Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks
## Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks
Andy Piazza
Published: July 30, 2026
Threat Research
Vulnerabilities
ChatGPT
Claude code
CVEs
DeepSeek
Exploitation
Hermes Agent
## Executive Summary
Unit 42 identified an AI-enabled autonomous hacking campaign carried out by a Chinese-speaking threat actor. They targeted infrastructure using seven vulnerabilities, combining autonomous AI-driven enumeration with manual exploitation that achieved confirmed impact.
The actor, operating under the aliases knaithe and KnYuan , leveraged DeepSeek , via the Hermes Agent framework, as their autonomous offensive operator. They orchestrated this operator via Telegram for the following activities:
Independently enumerating targets and their vulnerabiliti
Hackernews
⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More
blogs_hackernews·2026-07-27
CVE-2026-16232 ⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More
Monday starts with the usual promise that everything is under control. Then the logs wake up.
This week, trusted tools crossed lines, old flaws found new work, exposed systems stayed exposed, and attackers kept hiding inside normal-looking services. Nothing looked strange at first. That helped.
That is the mood. Here is the full recap.
## ⚡ Threat of the Week
OpenAI Says Its AI Agent Went Rogue and Targeted Hugging Face - OpenAI disclosed that it lost control of two AI models during a security evaluation that ended in a breach o
Unit42
Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy
blogs_unit42·2026-07-17·CVSS 7.5
CVE-2025-40947 [HIGH] Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy
## Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy
Emmanuel Zhou
Adam Robbie
Rick Wyble
Miguel Pereira
Published: July 17, 2026
Threat Research
Vulnerabilities
Command injection
CVE-2025-40947
CVE-2025-40948
CVE-2025-40949
Exploit Chain
Privilege escalation
Rox II OT switches
## Executive Summary
We conducted this research in close partnership with Siemens, reflecting our shared commitment to advancing the security and resilience of critical infrastructure.
This report details a critical, chained exploit comprising three zero-day vulnerabilities (CVE-2025-40948, CVE-2025-40947, and CVE-2025-40949) discovered in Siemens ROX II operational technology (OT) switches. Successful exploitation of this chain would allow an attacker to achieve full privilege escal
2026-05-12
Published