PT-2025-22059 · Ruggedcom · Rox Rx1536+10
CVE-2025-40948
·
Published
2025-05-19
·
Updated
2026-06-29
CVSS v3.1
6.8
Medium
| Vector | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
RUGGEDCOM ROX MX5000 versions prior to V2.17.1
RUGGEDCOM ROX MX5000RE versions prior to V2.17.1
RUGGEDCOM ROX RX1400 versions prior to V2.17.1
RUGGEDCOM ROX RX1500 versions prior to V2.17.1
RUGGEDCOM ROX RX1501 versions prior to V2.17.1
RUGGEDCOM ROX RX1510 versions prior to V2.17.1
RUGGEDCOM ROX RX1511 versions prior to V2.17.1
RUGGEDCOM ROX RX1512 versions prior to V2.17.1
RUGGEDCOM ROX RX1524 versions prior to V2.17.1
RUGGEDCOM ROX RX1536 versions prior to V2.17.1
RUGGEDCOM ROX RX5000 versions prior to V2.17.1
Description
Improper input validation in the web server's JSON-RPC interface allows an authenticated remote attacker to read arbitrary files from the underlying operating system's filesystem with root privileges.
Recommendations
Update to version V2.17.1 or later.
Fix
RCE
Argument Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Rox Mx5000
Rox Mx5000Re
Rox Rx1400
Rox Rx1500
Rox Rx1501
Rox Rx1510
Rox Rx1511
Rox Rx1512
Rox Rx1524
Rox Rx1536
Rox Rx5000