CVE-2025-405917.7HighCWE-602

CVE-2025-40591: Siemens RUGGEDCOM ROX MX5000 vulnerability

Siemens · RUGGEDCOM ROX MX5000

Vendor fix available · Affected: Siemens RUGGEDCOM ROX MX5000 · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.7%probability of exploitation in the next 30 days

54th percentile

050100

Higher than 54% of scored CVEs

7.7HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (All versions < V2.16.5), RUGGEDCOM ROX RX1501 (All versions < V2.16.5), RUGGEDCOM ROX RX1510 (All versions < V2.16.5), RUGGEDCOM ROX RX1511 (All versions < V2.16.5), RUGGEDCOM ROX RX1512 (All versions < V2.16.5), RUGGEDCOM ROX RX1524 (All versions < V2.16.5), RUGGEDCOM ROX RX1536 (All versions < V2.16.5), RUGGEDCOM ROX RX5000 (All versions < V2.16.5). The 'Log Viewers' tool in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated remote attacker to execute the 'tail' command with root privileges and disclose contents of all files in the filesystem.

Affected products11

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Siemens · RUGGEDCOM ROX MX5000before V2.16.5
Siemens · RUGGEDCOM ROX MX5000REbefore V2.16.5
Siemens · RUGGEDCOM ROX RX1400before V2.16.5
Siemens · RUGGEDCOM ROX RX1500before V2.16.5
Siemens · RUGGEDCOM ROX RX1501before V2.16.5
Siemens · RUGGEDCOM ROX RX1510before V2.16.5
Siemens · RUGGEDCOM ROX RX1511before V2.16.5
Siemens · RUGGEDCOM ROX RX1512before V2.16.5
Siemens · RUGGEDCOM ROX RX1524before V2.16.5
Siemens · RUGGEDCOM ROX RX1536before V2.16.5
Siemens · RUGGEDCOM ROX RX5000before V2.16.5

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Client-Side Enforcement of Server-Side Security · Input Validation and Logic
Vendor: Siemens
Published: June 2025
Band: Unlikely (under 1%), June 2025

CoverageNo articles yet

No CyberSIXT article names CVE-2025-40591 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.