Is CVE-2025-40947 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-40947 being exploited in the wild.

How severe is CVE-2025-40947?

High severity, with a CVSS score of 7.5, published 12 May 2026.

Which products and versions are affected?

Siemens ROX MX5000 < V2.17.1; Siemens ROX MX5000RE < V2.17.1; Siemens ROX RX1400 < V2.17.1; Siemens ROX RX1500 < V2.17.1; and 18 more.

Is there a fix for CVE-2025-40947?

A patch was published on 2026-05-12: V2.17.1 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-40947 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2025-40947?

Check whether you run Siemens ROX MX5000, Siemens ROX MX5000RE, Siemens ROX RX1400 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-40947: Siemens RUGGEDCOM ROX command injection in feature key installation

Q: Which products and versions are affected?

Siemens ROX MX5000 < V2.17.1; Siemens ROX MX5000RE < V2.17.1; Siemens ROX RX1400 < V2.17.1; Siemens ROX RX1500 < V2.17.1; and 18 more.

Q: Is there a fix for CVE-2025-40947?

A patch was published on 2026-05-12: V2.17.1 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-40947 attacked?

It is attacked over the network, in an operating system.

Q: Am I affected by CVE-2025-40947?

Check whether you run Siemens ROX MX5000, Siemens ROX MX5000RE, Siemens ROX RX1400 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-40947 · Severity: high · CVSS 7.5 · Published 2026-05-12

Siemens RUGGEDCOM ROX devices, which are industrial Ethernet switches used in harsh environments like power substations and traffic control, are affected by a security flaw. An authorized user could exploit this vulnerability during the feature key installation process to take full control of the device. This could lead to unauthorized access to critical infrastructure networks, service disruptions, or the theft of sensitive operational data.

Technologies: Siemens RUGGEDCOM ROX MX5000, Siemens RUGGEDCOM ROX MX5000RE, Siemens RUGGEDCOM ROX RX1400, Siemens RUGGEDCOM ROX RX1500, Siemens RUGGEDCOM ROX RX1501, Siemens RUGGEDCOM ROX RX1510, Siemens RUGGEDCOM ROX RX1511, Siemens RUGGEDCOM ROX RX1512, Siemens RUGGEDCOM ROX RX1524, Siemens RUGGEDCOM ROX RX1536, Siemens RUGGEDCOM ROX RX5000. Vendors: Siemens.

Quick answers

Is CVE-2025-40947 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-40947 being exploited in the wild.
How severe is CVE-2025-40947?: High severity, with a CVSS score of 7.5, published 12 May 2026.
Which products and versions are affected?: Siemens ROX MX5000 < V2.17.1; Siemens ROX MX5000RE < V2.17.1; Siemens ROX RX1400 < V2.17.1; Siemens ROX RX1500 < V2.17.1; and 18 more.
Is there a fix for CVE-2025-40947?: A patch was published on 2026-05-12: V2.17.1 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-40947 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2025-40947?: Check whether you run Siemens ROX MX5000, Siemens ROX MX5000RE, Siemens ROX RX1400 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability (CWE-78) exists in the RUGGEDCOM ROX II operating system due to improper neutralization of special elements during the feature key installation process. An authenticated remote attacker with low privileges can exploit this by providing specially crafted input that is executed by the underlying operating system. Successful exploitation allows for remote code execution with root privileges. While the attack vector is network-based, the complexity is rated as high, likely due to specific preconditions or environmental factors required for the injection. Siemens has released firmware version V2.17.1 to address this issue.

Affected products

Siemens RUGGEDCOM ROX MX5000 < V2.17.1
Siemens RUGGEDCOM ROX MX5000RE < V2.17.1
Siemens RUGGEDCOM ROX RX1400 < V2.17.1
Siemens RUGGEDCOM ROX RX1500 < V2.17.1
Siemens RUGGEDCOM ROX RX1501 < V2.17.1
Siemens RUGGEDCOM ROX RX1510 < V2.17.1
Siemens RUGGEDCOM ROX RX1511 < V2.17.1
Siemens RUGGEDCOM ROX RX1512 < V2.17.1
Siemens RUGGEDCOM ROX RX1524 < V2.17.1
Siemens RUGGEDCOM ROX RX1536 < V2.17.1
Siemens RUGGEDCOM ROX RX5000 < V2.17.1

Timeline

2026-05-12: advisory: Initial publication by Siemens and NVD
2026-05-12: patched: V2.17.1 released to address the vulnerability

References

https://cert-portal.siemens.com/productcert/html/ssa-078743.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.