# Siemens Ruggedcom Rox Scheduler command injection flaw

Published: 2026-05-14 · Severity: routine · Sectors: manufacturing
Canonical: https://vorant.io/reports/fa603227-2b6c-5d0f-ba45-aeba4b267b36/siemens-ruggedcom-rox-scheduler-command-injection-flaw

> Authenticated attacker can inject OS commands to gain root on Siemens Ruggedcom Rox industrial controllers via unvalidated Scheduler input.

Siemens Ruggedcom Rox industrial networking devices contain an OS command injection vulnerability in the Scheduler functionality of the Web UI. An authenticated remote attacker can inject commands into task scheduling operations due to improper input sanitization, achieving arbitrary command execution with root privileges on the underlying operating system. The vulnerability affects 11 Ruggedcom Rox models including MX5000, RX series devices (RX1400 through RX1536), and RX5000, in all versions prior to 2.17.1. Siemens has released patched versions and recommends immediate update. The vulnerability requires authentication, which mitigates but does not eliminate risk in environments where access controls are weak or credentials compromised.

## Mentioned in this report

- Vulnerabilities: CVE-2025-40949

## Detection guidance (public sample)

### Command Injection Metacharacters in Scheduler Web Request

ATT&CK: T1190

Web requests to a scheduler-related URI whose query string carries shell metacharacters or command-substitution sequences, matching OS command injection in the Ruggedcom ROX Scheduler Web UI. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Command Injection Metacharacters in Scheduler Web Request
description: Detects web requests to scheduler-related URIs whose query string contains
  shell metacharacters or command substitution sequences (plain or URL-encoded). This
  matches the OS command injection pattern in the Scheduler function of the Siemens
  Ruggedcom ROX Web UI, where unsanitised task parameters reach a root shell. The
  rule only sees the URI and query string, so injections sent in POST bodies will
  not match. Tune the scheduler URI match to your device's actual paths.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains: schedul
  selection_inject:
    cs-uri-query|contains:
    - '%3B'
    - ;
    - '%7C'
    - '|'
    - '%60'
    - '`'
    - $(
    - '%24%28'
    - '&&'
    - '%26%26'
  condition: selection_uri and selection_inject
falsepositives:
- Legitimate scheduler parameters that contain semicolons or pipes, such as cron-style
  or delimited time lists
- Vulnerability scanners run by the asset owner against the device Web UI
level: medium
id: 460c4d5a-e5ee-587e-812a-62c0a99b88b8
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-12
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-12

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/fa603227-2b6c-5d0f-ba45-aeba4b267b36/siemens-ruggedcom-rox-scheduler-command-injection-flaw.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup