10 mincritical
Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy
A chained exploit comprising three zero-day vulnerabilities in Siemens ROX II OT switches allows an attacker to escalate from arbitrary file disclosure to full persistent root-level access. CVE-2025-40948 leverages a root-privileged xz utility to read any file on the filesystem, CVE-2025-40947 exploits unsanitized input in the feature key signature verification to achieve command injection as root, and CVE-2025-40949 enables persistent code execution by injecting commands into the root cron table via the web management task scheduler. Siemens has released firmware V2.17.1 to address all three vulnerabilities.
Sens:▲ 24h
Detection / Hunteropenrouter
What Happened
Security researchers discovered three previously unknown vulnerabilities in Siemens Ruggedcom ROX II network switches used in industrial environments like factories and power plants. When chained together, these vulnerabilities allow an attacker to gain full, persistent control of the switch, potentially turning a device meant to protect the network into a tool for further attacks. The first flaw lets attackers read sensitive files, the second lets them run commands with administrator privileges, and the third ensures their access survives device reboots. Organizations using these switches should update to firmware version V2.17.1 as soon as possible and consider network-level virtual patching if immediate updates are not feasible.
Key Takeaways
- Three chained zero-day vulnerabilities (CVE-2025-40948, CVE-2025-40947, CVE-2025-40949) in Siemens ROX II OT switches enable full root-level compromise and persistent access.
- The exploit chain progresses from arbitrary file disclosure via misused xz utility, to privilege escalation via command injection in feature key validation, to persistent root code execution via task scheduler manipulation.
- Siemens has released firmware V2.17.1 to remediate all three vulnerabilities; affected devices running earlier firmware are at risk.
- Palo Alto Networks has released Threat Prevention signatures 97246, 97250, and 97249 for virtual patching via Advanced Threat Prevention.
- The vulnerabilities highlight that OT switches, even on isolated networks, are susceptible to software flaws and require defense-in-depth strategies including timely patching and network-layer compensating controls.
Affected Systems
- Siemens Ruggedcom ROX II switches (firmware versions prior to V2.17.1)
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2025-40948 | Siemens Ruggedcom ROX II (firmware prior to V2.17.1) | Medium (CVSS 6.8) | Arbitrary file disclosure via insecure configuration of the xz utility running with root privileges, allowing an attacker to read any file on the switch's file system. |
| CVE-2025-40947 | Siemens Ruggedcom ROX II (firmware prior to V2.17.1) | High (CVSS 7.5) | Privilege escalation via command injection in the feature key validation function, which inserts an attacker-controlled signature string directly into a command executed with root privileges via system(). |
| CVE-2025-40949 | Siemens Ruggedcom ROX II (firmware prior to V2.17.1) | Critical (CVSS 9.1) | Persistent root code execution via improper input sanitization in the web management task scheduler, allowing an authenticated attacker to inject commands into the root cron table that survive reboots. |
Attack Chain
- Reconnaissance: Attacker exploits CVE-2025-40948 by passing file paths to the root-privileged xz utility with -f, -c, -d parameters to read sensitive files including password hashes and private keys
- Initial Access: Attacker uploads a malicious script (e.g., Python reverse shell) to a writable directory via the web UI's feature key file upload functionality
- Privilege Escalation: Attacker crafts a feature key file with a command injection payload in the signature field; the vulnerable gpgv verification function executes the injected command as root via system(), launching the uploaded script
- Persistence: Attacker exploits CVE-2025-40949 by injecting commands into the web management task scheduler, which writes to the root cron table, ensuring malicious code survives reboots
- Impact: Attacker maintains persistent root-level control of the OT switch, enabling data exfiltration, denial-of-service, or use as a platform for further network attacks
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Palo Alto Networks Next-Generation Firewall with Advanced Threat Prevention
Palo Alto Networks has released Threat Prevention signatures 97246, 97250, and 97249 for virtual patching via Advanced Threat Prevention. No YARA, Sigma, Snort/Suricata, or SIEM queries are provided in the article.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | ROX II is an embedded OT switch operating system; traditional EDR agents are unlikely to be installed. Visibility depends on network-based monitoring and OT-specific security platforms rather than host-based telemetry. |
| Network Visibility | Medium | Network-layer detection is possible via virtual patching signatures (Palo Alto ATP) that can detect and block exploit attempts targeting the web management interface. However, post-exploitation activity on the switch itself may not generate network-visible telemetry unless the attacker initiates outbound connections. |
| Detection Difficulty | Hard | OT switches typically lack host-based logging capabilities found in IT systems. Detecting the exploit chain requires network-layer monitoring of management interface traffic and behavioral analysis of task scheduler configurations on the device itself, which may require specialized OT security tooling. |
Required Log Sources
- OT switch management interface access logs
- Network flow data to/from ROX II switch management interfaces
- Palo Alto Networks NGFW Threat Prevention logs (signatures 97246, 97250, 97249)
- Web server logs from ROX II management interface
- Network IDS/IPS alerts targeting ROX II management traffic
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for xz utility execution with parameters -f, -c, and -d initiated by a privileged daemon process on ROX II switches, as this indicates potential exploitation of CVE-2025-40948 for arbitrary file disclosure. | OT switch process logs, syslog from ROX II devices, or network traffic captures of management sessions | Reconnaissance (CVE-2025-40948) | Low — xz with these specific parameters executed by a privileged daemon is unusual and unlikely to occur in normal operations. |
| Consider hunting for feature key file uploads to ROX II switches followed by execution of gpgv_tool or bash commands, which may indicate exploitation of CVE-2025-40947 command injection. | Web management interface logs, file upload audit logs, network traffic to management interface | Privilege Escalation (CVE-2025-40947) | Medium — legitimate feature key installations will also trigger gpgv execution; correlation with unusual file uploads or shell metacharacters in arguments is needed. |
| Consider hunting for unusual or unexpected entries in the root cron table or task scheduler configuration on ROX II switches, particularly entries invoking python, bash, or other interpreters, which may indicate CVE-2025-40949 persistence. | ROX II device configuration exports, syslog entries for scheduled task creation, OT security platform configuration monitoring | Persistence (CVE-2025-40949) | Low to Medium — legitimate scheduled tasks may exist, but entries invoking scripting languages or unexpected commands are suspicious. |
| Consider hunting for outbound connections from ROX II switches to unexpected destinations, which may indicate a reverse shell established via the command injection exploit chain. | Network flow data, firewall logs, NetFlow records | Post-exploitation | Medium — ROX II switches may have legitimate outbound connections for NTP, SNMP, or management; baseline behavior is needed. |
Control Gaps
- Traditional IT EDR solutions provide no visibility into embedded OT switch operating systems.
- Network segmentation alone does not protect against exploitation if an attacker has access to the management network.
- Signature-based AV/EDR on adjacent IT systems would not detect exploitation occurring directly on the OT switch.
- Lack of host-based logging on ROX II switches limits post-exploitation detection capabilities.
Key Behavioral Indicators
- xz utility execution with -f, -c, -d parameters by a privileged configuration daemon on ROX II switches
- Feature key file upload followed by gpgv_tool or bash execution with shell metacharacters in arguments
- Unexpected entries in ROX II root cron table invoking python, bash, or direct system calls
- Scheduled task creation via web management interface with input fields containing shell metacharacters
- Reverse shell connections originating from ROX II switch IP addresses to unexpected external destinations
False Positive Assessment
Low — The behavioral indicators described (xz with specific parameters by a privileged daemon, unexpected cron entries invoking scripting languages, feature key uploads followed by shell execution) are highly specific to the exploit chain and unlikely to occur in normal ROX II operations. However, legitimate feature key installations may produce similar gpgv execution patterns, requiring correlation with other indicators.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider updating affected Siemens Ruggedcom ROX II switches to firmware version V2.17.1, which remediates all three vulnerabilities.
- If your organization uses Palo Alto Networks NGFW with Advanced Threat Prevention, consider enabling Threat Prevention signatures 97246, 97250, and 97249 to provide virtual patching as a compensating control while firmware updates are scheduled.
- Consider restricting network access to ROX II switch management interfaces to only authorized administrative workstations or jump hosts to reduce exposure to exploitation.
- If you suspect compromise, consider engaging your incident response team or contacting Unit 42 Incident Response for assistance with forensic analysis of affected switches.
Infrastructure Hardening
- Evaluate whether management interfaces for OT switches can be placed on a dedicated management VLAN with strict access controls.
- Consider implementing network-level monitoring and intrusion detection for traffic targeting ROX II management interfaces.
- If applicable, evaluate deploying OT-specific security platforms that provide deep visibility and inline protection for industrial environments.
- Consider establishing a baseline of legitimate scheduled tasks and cron entries on ROX II switches to enable detection of anomalous persistence mechanisms.
User Protection
- Consider reviewing and tightening access controls for personnel who interact with ROX II switch management interfaces.
- Where supported by your tooling, consider implementing multi-factor authentication for access to OT switch management interfaces.
- Evaluate whether service accounts used for OT switch management follow least-privilege principles.
Security Awareness
- Consider incorporating awareness of OT device vulnerability risks into existing training programs for operational technology teams.
- Consider educating OT engineers on the importance of timely firmware updates and the risks of delaying patches in industrial environments.
- If applicable, consider cross-training between IT security and OT operations teams to improve coordination on vulnerability management for critical infrastructure devices.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping6 techniques
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Credential Access
Tactic
Discovery
Additional IOCs
- File Paths:
/tmp/rev_shell.py- Example path used in PoC for a malicious Python reverse shell script uploaded via the web UI feature key file upload functionality during CVE-2025-40947 exploitation.
- Command Lines:
- Purpose: Arbitrary file disclosure by misusing xz utility to read restricted files as root | Tools:
xz| Stage: Reconnaissance / Initial foothold (CVE-2025-40948) |xz -f -c -d - Purpose: Command injection via feature key signature verification using gpgv with unsanitized attacker input passed to system() | Tools:
bash,gpgv_tool,base64| Stage: Privilege escalation (CVE-2025-40947) |bash -c "gpgv_tool --keyring - Purpose: Execution of uploaded reverse shell script via command injection in feature key signature field | Tools:
python| Stage: Privilege escalation (CVE-2025-40947) |python /tmp/
- Purpose: Arbitrary file disclosure by misusing xz utility to read restricted files as root | Tools:
