What Changed
Palo Alto Networks’ Unit 42 OT Threat Research Lab, working with Siemens ProductCERT, has published details of three vulnerabilities in Siemens Ruggedcom ROX II, the operating system on Siemens OT switches. Chained together, they take an attacker from reading files to persistent root access on the device. Siemens has released advisories SSA-973901, SSA-078743 and SSA-081142 and recommends updating affected devices to firmware V2.17.1.
How The Chain Works
- CVE-2025-40948 (CVSS 6.8): a root-privileged configuration daemon runs
xzwith user-supplied parameters. Using-f,-cand-dtogether turns it into a file reader, exposing password hashes, private keys and configuration files. - CVE-2025-40947 (CVSS 7.5): the feature-key (license) signature check inserts the signature string into a
gpgvcommand run withsystem()as root, without sanitization. An attacker uploads a script through the normal feature-key upload, then submits a crafted key whose signature field runs it. - CVE-2025-40949 (CVSS 9.1): the web management task scheduler lets an authenticated attacker inject commands into the root cron table, giving persistence across reboots.
Why This Is An Operations Problem
OT switches provide the segmentation between HMIs, PLCs and the rest of the network. Unit 42 notes that these devices are often assumed safe because they sit on isolated networks, yet a compromised switch can be used to observe or disrupt industrial traffic. Firmware updates in OT environments also tend to need maintenance windows, which stretches exposure.
What To Verify First
- Inventory ROX II devices and schedule the V2.17.1 update.
- Limit access to switch web management interfaces to dedicated engineering networks and review who holds accounts.
- Look for the behavior indicators Unit 42 lists:
xzrun with-f -c -dby the configuration daemon, and scheduled tasks running python, bash or other unexpected commands. - Where patching must wait, consider compensating controls such as IPS signatures in front of management interfaces.
What Teams May Be Underestimating
The final stage needs an authenticated user, so credential hygiene on network gear matters. The file-disclosure step can expose exactly the hashes and keys that make authentication easier, which is why the three flaws should be fixed together.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
