# CVE-2025-40948: Siemens RUGGEDCOM ROX argument injection in JSON-RPC interface

Source: https://junglewise.ai/threats/cve-2025-40948-siemens-ruggedcom-rox-argument-injection-in-json-rpc-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2025-40948 · Severity: high · CVSS 6.8 · Published 2026-05-12

Siemens RUGGEDCOM ROX devices, which are industrial Ethernet switches used in harsh environments like power substations, contain a security vulnerability in their web management interface. An authorized user with high-level permissions could exploit this flaw to access sensitive system files that should normally be protected. This could lead to the exposure of configuration data or other critical system information, potentially compromising the integrity of the industrial network.

Technologies: [Siemens RUGGEDCOM ROX MX5000](https://junglewise.ai/threats/technologies/ruggedcom-rox-mx5000), [Siemens RUGGEDCOM ROX MX5000RE](https://junglewise.ai/threats/technologies/ruggedcom-rox-mx5000re), [Siemens RUGGEDCOM ROX RX1400](https://junglewise.ai/threats/technologies/ruggedcom-rox-rx1400), [Siemens RUGGEDCOM ROX RX1500](https://junglewise.ai/threats/technologies/ruggedcom-rox-rx1500), [Siemens RUGGEDCOM ROX RX1501](https://junglewise.ai/threats/technologies/ruggedcom-rox-rx1501), [Siemens RUGGEDCOM ROX RX1510](https://junglewise.ai/threats/technologies/ruggedcom-rox-rx1510), [Siemens RUGGEDCOM ROX RX1511](https://junglewise.ai/threats/technologies/ruggedcom-rox-rx1511), [Siemens RUGGEDCOM ROX RX1512](https://junglewise.ai/threats/technologies/ruggedcom-rox-rx1512), [Siemens RUGGEDCOM ROX RX1524](https://junglewise.ai/threats/technologies/ruggedcom-rox-rx1524), [Siemens RUGGEDCOM ROX RX1536](https://junglewise.ai/threats/technologies/ruggedcom-rox-rx1536), [Siemens RUGGEDCOM ROX RX5000](https://junglewise.ai/threats/technologies/ruggedcom-rox-rx5000). Vendors: [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2025-40948 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-40948 being exploited in the wild.

**How severe is CVE-2025-40948?** High severity, with a CVSS score of 6.8, published 12 May 2026.

**Which products and versions are affected?** Siemens RUGGEDCOM ROX MX5000 < 2.17.1, < V2.17.1; Siemens RUGGEDCOM ROX MX5000RE < 2.17.1, < V2.17.1; Siemens RUGGEDCOM ROX RX1400 < 2.17.1, < V2.17.1; Siemens RUGGEDCOM ROX RX1500 < 2.17.1, < V2.17.1; and 7 more.

**Is there a fix for CVE-2025-40948?** A patch was published on 2026-05-12. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-40948 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2025-40948?** Check whether you run Siemens RUGGEDCOM ROX MX5000, Siemens RUGGEDCOM ROX MX5000RE, Siemens RUGGEDCOM ROX RX1400 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability classified as Improper Neutralization of Argument Delimiters (CWE-88) exists in the JSON-RPC interface of the RUGGEDCOM ROX web server. The issue stems from insufficient validation of user-supplied input, which can be manipulated to perform argument injection. An authenticated remote attacker with high privileges (PR:H) can exploit this to read arbitrary files from the underlying Linux filesystem with root-level access. Siemens has addressed this in version V2.17.1 by improving input validation routines.

## Affected products

- Siemens RUGGEDCOM ROX MX5000 < V2.17.1
- Siemens RUGGEDCOM ROX MX5000RE < V2.17.1
- Siemens RUGGEDCOM ROX RX1400 < V2.17.1
- Siemens RUGGEDCOM ROX RX1500 < V2.17.1
- Siemens RUGGEDCOM ROX RX1501 < V2.17.1
- Siemens RUGGEDCOM ROX RX1510 < V2.17.1
- Siemens RUGGEDCOM ROX RX1511 < V2.17.1
- Siemens RUGGEDCOM ROX RX1512 < V2.17.1
- Siemens RUGGEDCOM ROX RX1524 < V2.17.1
- Siemens RUGGEDCOM ROX RX1536 < V2.17.1
- Siemens RUGGEDCOM ROX RX5000 < V2.17.1

## Timeline

- 2026-05-12: disclosed
- 2026-05-12: patched
- 2026-05-12: advisory

## References

- [https://cert-portal.siemens.com/productcert/html/ssa-973901.html](https://cert-portal.siemens.com/productcert/html/ssa-973901.html)

## Related threats

- [Siemens RUGGEDCOM ROX command injection in Scheduler Web UI](https://junglewise.ai/threats/cve-2025-40949-siemens-ruggedcom-rox-command-injection-in-scheduler-web-ui)
- [Siemens RUGGEDCOM ROX command injection in feature key installation](https://junglewise.ai/threats/cve-2025-40947-siemens-ruggedcom-rox-command-injection-in-feature-key)
- [Denx U-Boot infinite recursion in DOS partition table parsing](https://junglewise.ai/threats/cve-2019-13103-denx-u-boot-infinite-recursion-in-dos-partition-table-parsing)