Command Injection Vulnerability in RUGGEDCOM ROX Products by Siemens

CVE-2025-40591

What is CVE-2025-40591?

A command injection vulnerability exists in various RUGGEDCOM ROX devices, which allows an authenticated attacker to exploit the 'Log Viewers' tool within the web interface. Due to inadequate input sanitation on the server side, attackers can execute the 'tail' command with elevated privileges, potentially exposing the contents of sensitive files across the filesystem.

References