Palo Alto Networks’ Unit 42 disclosed on July 17, 2026 a chain of three vulnerabilities in Siemens Ruggedcom ROX II, the operating system that runs industrial network switches deployed in rail, energy, and manufacturing environments, that together let an attacker escalate from limited access to persistent root control of the device.
The chain works in stages, according to Unit 42’s writeup. CVE-2025-40948 lets an attacker read arbitrary files because a privileged daemon insecurely passes user-supplied parameters to the xz utility. CVE-2025-40947, rated high severity, stems from a feature-key validation function that fails to sanitize input before it reaches a root-privileged command, opening a path to direct command injection. CVE-2025-40949, the most severe at CVSS 9.1, lets an attacker inject commands into the device’s root cron table through its web management task scheduler, which gives the attacker persistence that survives a reboot. Unit 42 researchers Emmanuel Zhou, Adam Robbie, Rick Wyble, and Miguel Pereira found the chain through coordinated disclosure with Siemens; the post describes no evidence of active exploitation.
The insight worth sitting with is what “responsible disclosure” means for OT gear versus IT gear. A ROX II switch that goes fully compromised does not just leak data, it can become a persistent foothold inside a rail or energy network’s most sensitive segment, and firmware updates on industrial switches move far slower than a browser patch cycle. Security teams running Ruggedcom ROX II should update to firmware V2.17.1, referenced in Siemens advisories SSA-973901, SSA-078743, and SSA-081142, and should not assume “no active exploitation yet” buys much time once a technical write-up like this one is public. The same collapsing gap between disclosure and weaponization drove CyberTech’s recent reporting on NetScaler and ColdFusion flaws being exploited within hours of disclosure.
Source: Palo Alto Networks Unit 42
