Siemens ROX II OT Switch Zero-Day Vulnerabilities Analysis: RCE, LPE, and Persistence via CVE-2025-40948-40949

Vulnerability Overview This report details three zero-day vulnerabilities (CVE-2025-40948, CVE-2025-40947, and CVE-2025-40949) discovered in Siemens ROX II Operational Technology (OT) switches. The combination of these vulnerabilities allows attackers to achieve full privilege escalation and persistent root-level access, posing a significant threat to industrial control networks. 1. Arbitrary File Disclosure (CVE-2025-40948): Attackers exploit an insecure configuration to read any file in the switch’s file system with root privileges. This vulnerability can leak sensitive configuration information, password hashes, and private keys. 2. Privilege Escalation via Command Injection (CVE-2025-40947): A critical flaw exists in the feature key verification function, which fails to sanitize user-controlled payloads before directly inserting them into commands executed with root privileges. This allows for direct command injection and complete root access. 3. Persistent Root Code Execution (CVE-2025-40949): By exploiting the switch’s task scheduling functionality, attackers can inject malicious commands into the system crontab, achieving persistent code execution that maintains control even after system reboot. Scope of Impact These vulnerabilities can transform critical network devices into platforms for malicious activities, severely threatening the integrity and availability of industrial networks. Affected devices include Siemens ROX II switches; updating to firmware version V2.17.1 is recommended to remediate these issues. Remediation Firmware Update: Customers are advised to update affected ROX II devices to firmware version V2.17.1. Virtual Patch Detection Signatures: Palo Alto Networks provides virtual patch detection signatures via its Next-Generation Firewall (NGFW) and Advanced Threat Prevention (ATP) services. OT Device Hardening: Strengthen security measures on OT devices to prevent potential attacks. POC Code or Exploit Code No specific POC code or exploit code is provided on the page, but the following code snippet description is mentioned: This description indicates that a code snippet exists demonstrating how to exploit a command injection vulnerability to execute code, but the specific code content is not provided on the page.

Goal Reached Thanks to every supporter — we hit 100%!

Siemens ROX II OT Switch Zero-Day Vulnerabilities Analysis: RCE, LPE, and Persistence via CVE-2025-40948-40949