# Siemens ROX II Zero-Day Trilogy: Chained OT Switch Flaws

> Siemens and Unit 42 disclose three zero-day vulnerabilities in ROX II switches enabling full root compromise. Patch to firmware V2.17.1.

- Published: 2026-08-08T08:34:36.000Z
- Severity: high
- Category: Vulnerabilities
- Tags: Zero-Day, OT Security, CVE-2025-40948, CVE-2025-40947, CVE-2025-40949
- CVEs: CVE-2025-40948 (CVSS 6.8), CVE-2025-40947 (CVSS 7.5), CVE-2025-40949 (CVSS 9.1)
- Author: Runtime Rebel Intel
- Primary source: https://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilities/
- Canonical: https://runtimerebel.com/blog/siemens-rox-ii-zero-day-trilogy-chained-ot-switch-flaws

## Key points

- Immediate impact: Industrial control networks face potential root-level compromise and persistent unauthorized access via critical operational technology switches.
- Affected systems: Siemens Ruggedcom ROX II operational technology switches running firmware versions prior to V2.17.1.
- Remediation: Update affected Siemens ROX II devices to firmware version V2.17.1 immediately according to vendor advisories.

Researchers have detailed a sophisticated [zero-day](/glossary#zero-day) attack chain affecting operational technology switches manufactured by Siemens, according to research published by [Unit 42](https://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilities/). The research outlines three distinct software flaws combined into a sequential [exploit](/glossary#exploit) targeting the Ruggedcom ROX II platform. Successful execution of this trilogy grants an attacker persistent, root-level control over critical network infrastructure devices.

## Technical Details of the Siemens ROX II Zero-Day Chain

The identified vulnerabilities progress through three distinct operational stages, moving from initial [reconnaissance](/glossary#reconnaissance) to full system [persistence](/glossary#persistence) within industrial control environments. Industrial switches function as the backbone of operational networks, making compromise of these systems particularly dangerous.

### Stage 1: Reconnaissance via Arbitrary File Disclosure

The attack begins with [CVE-2025-40948](https://nvd.nist.gov/vuln/detail/CVE-2025-40948), an arbitrary file disclosure [vulnerability](/glossary#vulnerability) possessing a [CVSS](/glossary#cvss) 3.1 score of 6.8. Researchers discovered that a privileged management daemon improperly utilizes the standard Linux `xz` utility with specific parameters (`-f`, `-c`, and `-d`). This misconfiguration allows the daemon to read arbitrary system files. Attackers leverage this flaw to extract sensitive operating system data, including password hashes and internal network topology maps, providing necessary intelligence for subsequent steps.

### Stage 2: [Privilege Escalation](/glossary#privilege-escalation) via Feature Key Logic

Following initial information gathering, an attacker exploits [CVE-2025-40947](https://nvd.nist.gov/vuln/detail/CVE-2025-40947), a privilege escalation flaw scored 7.5 on the CVSS 3.1 scale. This vulnerability resides in the switch's feature key functionality, a mechanism designed to unlock optional device capabilities. By reverse-engineering the internal validation logic of this feature, unprivileged actors can bypass security controls and gain administrative root access to the underlying operating system.

### Stage 3: Persistence via Task Scheduling

The final component of the trilogy is [CVE-2025-40949](https://nvd.nist.gov/vuln/detail/CVE-2025-40949), carrying a severe CVSS 3.1 score of 9.1. An authenticated actor exploits the switch task scheduling interface to configure automated execution of malicious scripts at predetermined intervals. Because these scripts execute with root privileges, the compromise survives device reboots, ensuring long-term persistence for [data exfiltration](/glossary#data-exfiltration) or operational disruption.

## Actionable Recommendations and Mitigations

Defenders responsible for securing industrial control systems and operational technology environments should prioritize the following remediation steps:

* **Apply [Firmware](/glossary#firmware) Updates:** Siemens has released security advisories SSA-973901, SSA-078743, and SSA-081142. Organizations must update all affected Ruggedcom ROX II devices to firmware version V2.17.1 immediately.
* **Audit [Network Segmentation](/glossary#network-segmentation):** Ensure that management interfaces for operational technology switches are strictly isolated from enterprise networks and restricted to dedicated administrative VLANs.
* **Monitor Administrative Access:** Implement rigorous logging and monitoring for unauthorized attempts to access feature key mechanisms or schedule anomalous background tasks on network hardware.

**Related:** [CVE-2026-42897: Microsoft Exchange Server Zero-Day Exploited in Wild](/blog/cve-2026-42897-microsoft-exchange-server-zero-day-exploited-in-wild), [Russian APT Exploits Zimbra Zero-Day to Exfiltrate Mail and 2FA Codes](/blog/russian-apt-exploits-zimbra-zero-day-to-exfiltrate-mail-and-2fa-codes)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/siemens-rox-ii-zero-day-trilogy-chained-ot-switch-flaws