Siemens Ruggedcom Rox Scheduler command injection flaw
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Authenticated attacker can inject OS commands to gain root on Siemens Ruggedcom Rox industrial controllers via unvalidated Scheduler input.
Siemens Ruggedcom Rox industrial networking devices contain an OS command injection vulnerability in the Scheduler functionality of the Web UI. An authenticated remote attacker can inject commands into task scheduling operations due to improper input sanitization, achieving arbitrary command execution with root privileges on the underlying operating system. The vulnerability affects 11 Ruggedcom Rox models including MX5000, RX series devices (RX1400 through RX1536), and RX5000, in all versions prior to 2.17.1. Siemens has released patched versions and recommends immediate update. The vulnerability requires authentication, which mitigates but does not eliminate risk in environments where access controls are weak or credentials compromised.
Mentioned in this report
Detection guidance
Command Injection Metacharacters in Scheduler Web Request
Web requests to a scheduler-related URI whose query string carries shell metacharacters or command-substitution sequences, matching OS command injection in the Ruggedcom ROX Scheduler Web UI. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Command Injection Metacharacters in Scheduler Web Request
description: Detects web requests to scheduler-related URIs whose query string contains
shell metacharacters or command substitution sequences (plain or URL-encoded). This
matches the OS command injection pattern in the Scheduler function of the Siemens
Ruggedcom ROX Web UI, where unsanitised task parameters reach a root shell. The
rule only sees the URI and query string, so injections sent in POST bodies will
not match. Tune the scheduler URI match to your device's actual paths.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: webserver
detection:
selection_uri:
cs-uri-stem|contains: schedul
selection_inject:
cs-uri-query|contains:
- '%3B'
- ;
- '%7C'
- '|'
- '%60'
- '`'
- $(
- '%24%28'
- '&&'
- '%26%26'
condition: selection_uri and selection_inject
falsepositives:
- Legitimate scheduler parameters that contain semicolons or pipes, such as cron-style
or delimited time lists
- Vulnerability scanners run by the asset owner against the device Web UI
level: medium
id: 460c4d5a-e5ee-587e-812a-62c0a99b88b8
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-12
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-12
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs