RUGGEDCOM ROX CVE-2025-40949

Upgrade all affected RUGGEDCOM ROX devices to firmware version V2.17.1 or later, which includes proper input sanitization in the Scheduler functionality. Siemens Product CERT advisory SSA-081142 provides download links and update instructions at https://cert-portal.siemens.com/productcert/html/ssa-081142.html. Organizations unable to immediately patch should implement compensating controls: restrict Web UI access to dedicated management VLANs with strict firewall rules blocking external access (reduces AV:N to AV:A), enforce multi-factor authentication for all administrative accounts accessing the Web UI, implement privileged access management (PAM) solutions with session recording to detect abuse of legitimate admin credentials, disable the Scheduler functionality entirely if not operationally required (eliminates the vulnerable code path but impacts automation capabilities), and deploy network intrusion detection systems (IDS) with signatures for command injection attempts targeting web parameters associated with task scheduling. Monitor system logs for unexpected scheduled task creation or modification, particularly tasks executing shell commands or scripts. Apply defense-in-depth by running RUGGEDCOM devices in isolated network segments with monitored traffic to critical systems. Note that disabling Scheduler may impact operational workflows relying on automated configuration changes or maintenance tasks, requiring manual intervention.