Multiple vulnerabilities in Siemens RUGGEDCOM ROX II

Published: 2025-12-10

Risk	Medium
Patch available	YES
Number of vulnerabilities	6
CVE-ID	CVE-2024-56835 CVE-2024-56836 CVE-2024-56837 CVE-2024-56838 CVE-2024-56839 CVE-2024-56840
CWE-ID	CWE-74 CWE-77
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	RUGGEDCOM ROX II Hardware solutions / Firmware
Vendor	Siemens

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Improper Neutralization of Special Elements in Output Used by a Downstream Component

EUVDB-ID: #VU119805

Risk: Medium

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-56835

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the DHCP Server configuration file is subject to code injection. A remote user can spawn a reverse shell and gain root access on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

RUGGEDCOM ROX II: before 2.17.0

CPE2.3

cpe:2.3:h:siemens:ruggedcom_rox_ii:*:*:*:*:*:*:*:*

External links

https://cert-portal.siemens.com/productcert/html/ssa-912274.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Command Injection

EUVDB-ID: #VU119806

Risk: Medium

CVSSv4.0: 5.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-56836

CWE-ID: CWE-77 - Command injection

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary commands on the system.

The vulnerability exists due to insufficient input validation during the Dynamic DNS configuration. A remote user can pass specially crafted data to the application and execute arbitrary commands.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

RUGGEDCOM ROX II: before 2.17.0

CPE2.3

cpe:2.3:h:siemens:ruggedcom_rox_ii:*:*:*:*:*:*:*:*

External links

https://cert-portal.siemens.com/productcert/html/ssa-912274.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Command Injection

EUVDB-ID: #VU119807

Risk: Low

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56837

CWE-ID: CWE-77 - Command injection

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary commands on the system.

The vulnerability exists due to insufficient input validation during the installation and load of certain configuration files. A remote administrator can pass specially crafted data to the application and execute arbitrary commands.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

RUGGEDCOM ROX II: before 2.17.0

CPE2.3

cpe:2.3:h:siemens:ruggedcom_rox_ii:*:*:*:*:*:*:*:*

External links

https://cert-portal.siemens.com/productcert/html/ssa-912274.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper Neutralization of Special Elements in Output Used by a Downstream Component

EUVDB-ID: #VU119808

Risk: Low

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56838

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the SCEP client for secure certificate enrollment lacks validation of multiple fields. A remote administrator can execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

RUGGEDCOM ROX II: before 2.17.0

CPE2.3

cpe:2.3:h:siemens:ruggedcom_rox_ii:*:*:*:*:*:*:*:*

External links

https://cert-portal.siemens.com/productcert/html/ssa-912274.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper Neutralization of Special Elements in Output Used by a Downstream Component

EUVDB-ID: #VU119809

Risk: Low

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56839

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to insufficient input validation when using VRF (Virtual Routing and Forwarding). A remote administrator can execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

RUGGEDCOM ROX II: before 2.17.0

CPE2.3