CVE-2025-3576 Siemens CVE debrief

Who should care

Operators, administrators, and asset owners responsible for Siemens RUGGEDCOM ROX MX5000 and related ROX models should review this advisory, especially if Kerberos/GSSAPI is enabled and RC4 is still allowed or preferred. Security teams supporting industrial or remote-access environments using these devices should confirm upgrade plans and encryption settings.

Technical summary

The advisory describes a spoofing issue in the MIT Kerberos implementation used by affected Siemens RUGGEDCOM ROX products. The weakness is tied to GSSAPI-protected messages that rely on RC4-HMAC-MD5: if RC4 is negotiated ahead of stronger encryption types, an attacker may be able to exploit MD5 collision properties to forge message integrity codes and tamper with message contents. The published CVSS vector reflects network attackability with high complexity and an integrity impact, without direct confidentiality or availability impact.

Defensive priority

Medium priority. The issue is exploitable over the network but requires high attack complexity, and the published impact is limited to integrity. Prioritize if the affected devices are exposed to untrusted networks or if RC4 remains enabled/preferred.

Recommended defensive actions

• Update Siemens RUGGEDCOM ROX devices to V2.17.1 or later, as directed by the vendor advisory.
• Verify whether RC4-HMAC-MD5 is enabled or preferred in Kerberos/GSSAPI configurations and switch to stronger encryption types where possible.
• Inventory affected RUGGEDCOM ROX models and versions, including MX5000 and the related ROX families named in the advisory.
• Review any services or integrations that depend on Kerberos-protected messaging for message integrity or device authentication.
• Track Siemens ProductCERT and CISA advisory updates for any additional guidance or clarifications.

Evidence notes

The source corpus identifies the advisory as ICSA-26-134-16 and states that CISA published it on 2026-05-12, then republished Siemens ProductCERT SSA-577017 on 2026-05-14. The affected product list in the advisory includes Siemens RUGGEDCOM ROX MX5000 and related ROX models, with a remediation to update to V2.17.1 or later. The CVE description supplied in the corpus attributes the issue to MIT Kerberos RC4-HMAC-MD5 message spoofing via MD5 checksum weaknesses. No exploit steps or code are included here.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.