Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy

A collaborative research effort between Palo Alto Networks and Siemens has uncovered a critical, chained exploit within the Siemens ROX II operational technology (OT) switches. The vulnerability chain consists of three zero-day flaws – CVE-2025-40948 (arbitrary file disclosure), CVE-2025-40947 (command injection via feature key validation), and CVE-2025-40949 (persistent code execution via task scheduling). Successful exploitation allows an attacker to achieve full privilege escalation and persistent root-level access, transforming the switch into a platform for malicious activity. Siemens has released security advisories to address these issues, recommending firmware updates.

This research, conducted in close partnership with Siemens, details a critical, chained exploit targeting these OT switches. The vulnerabilities could collectively transform a vital network security device into a platform for malicious activity, severely threatening the integrity and availability of the industrial network.

Siemens has released security advisories SSA-973901, SSA-078743 and SSA-081142 to address these issues, which recommend that customers update their affected ROX II devices to firmware version V2.17.1.

The attack vector proceeds in three stages, escalating from reconnaissance to complete system compromise:

• **Arbitrary File Disclosure (CVE-2025-40948):** An attacker leverages an insecure configuration of the xz utility, which executes with root privileges, to read any file on the switch’s file system. This vulnerability enables initial reconnaissance that could reveal critical information such as sensitive configuration files, password hashes and private cryptographic keys. The xz command is a common Linux utility primarily used for compressing files into the XZ format with a highly effective compression algorithm. However, xz can be used with specific parameters to function like the standard Linux cat command, which is used to print files to standard output. By supplying the parameters -f, -c and -d at the same time, an attacker can instruct xz to view file contents.
• **Privilege Escalation via Command Injection (CVE-2025-40947):** This critical flaw resides in the feature key validation function. The function fails to sanitize an attacker-controlled payload before inserting it directly into a command executed with root privileges. Exploiting this allows for direct command injection and full root access. The vulnerability lies in the signature verification function. This function is responsible for validating the signature provided in the feature key. The function involves three important steps: Read and parse: The function reads from the feature key file and parses a signature line containing up to a fixed number of characters; Command preparation: It then prepares a Linux command to verify the signature using the gpgv utility, inserting the parsed signature string directly into the command; Command execution: Finally, it executes the constructed command using system() with root privileges. To exploit this vulnerability, an attacker needs to craft a payload that fits within the signature field size limit. The exploitation process involves two main steps: File upload: The attacker first uses the web UI’s normal file upload functionality for a feature key to upload a malicious script (e.g., a Python reverse shell) to a writable directory on the switch. Command injection: Next, the attacker crafts a new feature key file where the signature field contains a command injection payload. This payload is designed to execute the malicious script that was previously uploaded.
• **Persistent Root Code Execution (CVE-2025-40949):** Following privilege escalation, the final vulnerability is exploited in the switch’s web management task scheduler. Improper input sanitization allows an authenticated attacker to inject malicious commands into the system’s root cron table. This establishes persistent code execution, surviving system reboots and maintaining full control. An authenticated attacker can manipulate input fields within the web management interface used to configure scheduled tasks. Due to improper sanitization and validation of user-supplied data, the attacker can inject control characters and commands into the underlying system configuration file responsible for task execution.

Exploiting this vulnerability involves several steps that an authenticated attacker can perform via the web management interface. The research highlights the importance of robust input validation and secure coding practices, especially when handling external data and executing system commands.

Palo Alto Networks customers are better protected against these threats through the following products and services: - Virtual patching detection signatures available via the Next-Generation Firewall with Advanced Threat Prevention - OT Device Security

Siemens has released security advisories SSA-973901, SSA-078743 and SSA-081142 to address these issues, which recommend that customers update their affected ROX II devices to firmware version V2.17.1.

This collaboration reflects the growing importance of industry partnerships in securing OT environments. As critical infrastructure enters the AI era, organizations must work together more closely than ever to address emerging threats, accelerate vulnerability remediation and strengthen the security of the technologies that support essential services worldwide.