CVE-2025-32469

The vulnerability results from lack of input data validation on the server side (CWE-602 — violation of the principle of enforcing security solely on the server side). The 'ping' tool in the web interface passes data provided by the user directly to the operating system without proper sanitization. An authenticated attacker can inject additional system commands that will be executed in the context of a process running with root privileges.

An attacker with access to the device's web interface can execute arbitrary code with root privileges, enabling complete takeover of the device, modification of configuration, disruption of its operation, or use it as an entry point to the industrial network.

Firmware of all vulnerable devices must be updated to version V2.16.5 or newer. Detailed update instructions are available in the Siemens security bulletin at: https://cert-portal.siemens.com/productcert/html/ssa-301229.html. Until the patch is deployed, it is recommended to restrict access to the device's web interface exclusively to trusted networks and authorized users.

All software versions prior to V2.16.5 of the following devices: RUGGEDCOM ROX MX5000, MX5000RE, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536 and RX5000.