Authentication Bypass in RUGGEDCOM ROX Devices by Siemens

CVE-2025-40761

What is CVE-2025-40761?

A vulnerability in various RUGGEDCOM ROX devices by Siemens allows unauthorized access through the Built-In-Self-Test (BIST) mode. Attackers with physical access to the serial interface could bypass authentication, granting them root shell access to the device. This presents significant security risks, as it could lead to further exploitation or manipulation of the device settings and configurations. Organizations utilizing these devices should ensure strict physical security measures and may need to evaluate available mitigation strategies.

References