CVE-2025-33024 Details
Description
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (All versions < V2.16.5), RUGGEDCOM ROX RX1501 (All versions < V2.16.5), RUGGEDCOM ROX RX1510 (All versions < V2.16.5), RUGGEDCOM ROX RX1511 (All versions < V2.16.5), RUGGEDCOM ROX RX1512 (All versions < V2.16.5), RUGGEDCOM ROX RX1524 (All versions < V2.16.5), RUGGEDCOM ROX RX1536 (All versions < V2.16.5), RUGGEDCOM ROX RX5000 (All versions < V2.16.5). The 'tcpdump' tool in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.
A command injection vulnerability has been identified in the web interface of several RUGGEDCOM ROX II devices, all versions prior to 2.16.5. The issue arises in the 'tcpdump' tool, which is vulnerable due to inadequate server-side input validation. This flaw could enable an authenticated remote attacker to execute arbitrary code with root privileges on the affected device.
Users are advised to update to version 2.16.5 or later. For more information, visit the Siemens Industry Support page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 13, 2025CISA-ADP
Assessed May 13, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert-portal.siemens.com/productcert/html/ssa-301229.html | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-602 | Client-Side Enforcement of Server-Side Security | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Siemens RUGGEDCOM ROX MX5000 | < V2.16.5 |
CPE
Remediation
| |
| Siemens RUGGEDCOM ROX MX5000RE | All versions |
CPE
Remediation
| |
| Siemens RUGGEDCOM ROX RX1400 | < V2.16.5 |
CPE
Remediation
| |
| Siemens RUGGEDCOM ROX RX1500 | < V2.16.5 |
CPE
Remediation
| |
| Siemens RUGGEDCOM ROX RX1501 | < V2.16.5 |
CPE
Remediation
| |
| Siemens RUGGEDCOM ROX RX1510 | < V2.16.5 |
CPE
Remediation
| |
| Siemens RUGGEDCOM ROX RX1511 | < V2.16.5 |
CPE
Remediation
| |
| Siemens RUGGEDCOM ROX RX1512 | < V2.16.5 |
CPE
Remediation
| |
| Siemens RUGGEDCOM ROX RX1524 | < V2.16.5 |
CPE
Remediation
| |
| Siemens RUGGEDCOM ROX RX1536 | < V2.16.5 |
CPE
Remediation
| |
| Siemens RUGGEDCOM ROX RX5000 | < V2.16.5 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2025 | New CVE Received | [email protected] |