Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy
Summary: Unit 42 and Siemens disclosed a chain of three zero-day vulnerabilities in Siemens ROX II OT switches - CVE-2025-40948 (CVSS 6.8), CVE-2025-40947 (7.5), and CVE-2025-40949 (9.1) - that together allow an unprivileged attacker to reach full root-level access. The chain moves from arbitrary file disclosure through a feature-key signature verification flaw that enables command injection, to a task scheduler flaw that runs injected commands as root at set intervals and survives reboots.
Why it matters: The device meant to segment and protect an industrial network can be turned into a persistent root-level platform for data exfiltration or denial-of-service, and Siemens' fix requires updating affected ROX II devices to firmware V2.17.1 - a patch that still has to be tested and deployed across OT environments.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- OT / ICS & Critical Infrastructure
- Mentions
- CVE-2025-40947CVE-2025-40948CVE-2025-40949
- Related
- ⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, Click Fix Lures and More Cyber Risks ·Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026