PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-40947 Siemens CVE debrief

CVE-2025-40947 affects multiple Siemens RUGGEDCOM ROX devices when user-supplied input is not properly sanitized during feature key installation. According to the advisory, an authenticated remote attacker could inject arbitrary commands and achieve remote code execution with root privileges on the underlying operating system. Siemens and CISA list an update to V2.17.1 or later as the fix.

Vendor
Siemens
Product
RUGGEDCOM ROX MX5000
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-14
Advisory published
2026-05-12
Advisory updated
2026-05-14

Who should care

OT/ICS operators, network and security administrators, and maintenance teams responsible for Siemens RUGGEDCOM ROX MX5000, MX5000RE, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536, and RX5000 devices.

Technical summary

The advisory describes a command-injection condition during the feature key installation process caused by improper input sanitization. The reported attack vector is network-based with low privilege requirements (CVSS v3.1: AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and successful exploitation can yield root-level code execution on the device's underlying operating system.

Defensive priority

High: prioritize remediation on any affected RUGGEDCOM ROX device, especially if authenticated administrative access is used for feature key installation or if the devices are managed remotely.

Recommended defensive actions

  • Update affected devices to V2.17.1 or later, per the vendor remediation guidance.
  • Review who can perform feature key installation and restrict that capability to trusted administrative accounts.
  • Monitor and audit privileged access to the affected devices, with particular attention to feature key installation activities.
  • Validate device inventories against the affected product list in the advisory to confirm exposure.
  • Use CISA ICS recommended practices and defense-in-depth guidance to reduce the impact of command-injection flaws in OT environments.

Evidence notes

All substantive claims in this debrief are taken from the supplied CISA CSAF advisory ICSA-26-134-11, which republishes Siemens ProductCERT advisory SSA-078743. The source states that affected devices do not properly sanitize user-supplied input during feature key installation, enabling authenticated remote command injection and root RCE. The supplied CVSS vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H with a score of 7.5 (HIGH). Publication timing in the corpus is 2026-05-12, with a source modification/republication on 2026-05-14. The enrichment data indicates this is not a KEV-listed item.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-40947 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-40947

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-40947 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-40947

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-134-11.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-078743.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-078743.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-11

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.