Zero-day vulnerability chain enables root access and persistence on Siemens ROX II switches
A chain of three zero-day vulnerabilities in Siemens ROX II industrial switches allows attackers to escalate privileges and gain persistent root access. The exploit path moves from sensitive file disclosure to full system command injection and permanent persistence via the task scheduler. Update all affected ROX II devices to firmware version V2.17.1 immediately.
Summary
Security researchers at Palo Alto Networks Unit 42, working alongside Siemens, have identified a critical vulnerability chain affecting Ruggedcom ROX II operational technology (OT) switches. The vulnerabilities allow an attacker to move from initial reconnaissance of the file system to full, persistent root-level control over the device.
These switches serve as central communication hubs in industrial networks, connecting assets such as programmable logic controllers (PLCs) and human-machine interfaces (HMIs). A successful compromise could grant an attacker control over the network's nervous system, potentially disrupting critical infrastructure operations.
Technical details
The exploit chain consists of three distinct stages that escalate an attacker's level of access:
1. Arbitrary File Disclosure (CVE-2025-40948)
This stage targets a privileged management daemon that executes the xz utility with root privileges. By passing specific parameters--f, -c, and -d-an attacker can force the utility to act like the cat command, printing the contents of any file on the system to standard output. This allows for the theft of sensitive configuration files, password hashes, and private cryptographic keys.
2. Privilege Escalation via Command Injection (CVE-2025-40947) The second stage targets the switch's feature key validation function, a mechanism used to unlock specific capabilities via signed licenses. The function fails to sanitize user-controlled payloads before passing them into a command executed with root privileges. This flaw allows an attacker to inject arbitrary commands and gain full root access.
3. Persistent Root Code Execution (CVE-2025-40949) To ensure control survives system reboots, the final stage exploits the web management task scheduler. An authenticated attacker can inject malicious commands into the system's root cron table through improper input sanitization, establishing a permanent foothold on the device.
Affected products and fixed versions
Siemens has issued several security advisories to address these vulnerabilities: SSA-973901, SSA-078743, and SSA-081142.
| Product | Vulnerability | Severity (CVSS) | Fixed Version |
|---|---|---|---|
| Siemens ROX II | CVE-2025-40949 | 9.1 | V2.17.1 |
| Siemens ROX II | CVE-2025-40947 | 7.5 | V2.17.1 |
| Siemens ROX II | CVE-2025-40948 | 6.8 | V2.17.1 |
Defender guidance
The primary defense against this exploit chain is a firmware update. Siemens recommends that all customers running affected ROX II devices upgrade to firmware version V2.17.1.
Beyond patching, defenders should implement the following:
- Monitor Task Scheduling: Inspect system cron tables for unauthorized or unexpected entries that could indicate persistent malicious scripts.
- Audit Privileged Commands: Monitor for unusual executions of the
xzutility, particularly those involving parameters used to read file contents rather than compress them. - Network Segmentation: Ensure OT switches are properly segmented and isolated from untrusted networks to limit the reach of an initial compromise.
Sources
