Researchers have detailed a sophisticated zero-day attack chain affecting operational technology switches manufactured by Siemens, according to research published by Unit 42. The research outlines three distinct software flaws combined into a sequential exploit targeting the Ruggedcom ROX II platform. Successful execution of this trilogy grants an attacker persistent, root-level control over critical network infrastructure devices.
Technical Details of the Siemens ROX II Zero-Day Chain
The identified vulnerabilities progress through three distinct operational stages, moving from initial reconnaissance to full system persistence within industrial control environments. Industrial switches function as the backbone of operational networks, making compromise of these systems particularly dangerous.
Stage 1: Reconnaissance via Arbitrary File Disclosure
The attack begins with CVE-2025-40948, an arbitrary file disclosure vulnerability possessing a CVSS 3.1 score of 6.8. Researchers discovered that a privileged management daemon improperly utilizes the standard Linux xz utility with specific parameters (-f, -c, and -d). This misconfiguration allows the daemon to read arbitrary system files. Attackers leverage this flaw to extract sensitive operating system data, including password hashes and internal network topology maps, providing necessary intelligence for subsequent steps.
Stage 2: Privilege Escalation via Feature Key Logic
Following initial information gathering, an attacker exploits CVE-2025-40947, a privilege escalation flaw scored 7.5 on the CVSS 3.1 scale. This vulnerability resides in the switch’s feature key functionality, a mechanism designed to unlock optional device capabilities. By reverse-engineering the internal validation logic of this feature, unprivileged actors can bypass security controls and gain administrative root access to the underlying operating system.
Stage 3: Persistence via Task Scheduling
The final component of the trilogy is CVE-2025-40949, carrying a severe CVSS 3.1 score of 9.1. An authenticated actor exploits the switch task scheduling interface to configure automated execution of malicious scripts at predetermined intervals. Because these scripts execute with root privileges, the compromise survives device reboots, ensuring long-term persistence for data exfiltration or operational disruption.
Actionable Recommendations and Mitigations
Defenders responsible for securing industrial control systems and operational technology environments should prioritize the following remediation steps:
- Apply Firmware Updates: Siemens has released security advisories SSA-973901, SSA-078743, and SSA-081142. Organizations must update all affected Ruggedcom ROX II devices to firmware version V2.17.1 immediately.
- Audit Network Segmentation: Ensure that management interfaces for operational technology switches are strictly isolated from enterprise networks and restricted to dedicated administrative VLANs.
- Monitor Administrative Access: Implement rigorous logging and monitoring for unauthorized attempts to access feature key mechanisms or schedule anomalous background tasks on network hardware.
Related: CVE-2026-42897: Microsoft Exchange Server Zero-Day Exploited in Wild, Russian APT Exploits Zimbra Zero-Day to Exfiltrate Mail and 2FA Codes