RUGGEDCOM ROX MX5000 vulnerabilities

34 known vulnerabilities in RUGGEDCOM ROX MX5000 from Siemens. 34 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  RUGGEDCOM ROX MX5000: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-40949May 12, 2026Siemens

  A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEDCOM ROX RX1400 (All versions < V2.17.1), RUGGEDCOM ROX RX1500 (All versions < V2.17.1), RUGGEDCOM ROX RX1501 (All versi

• 7.5 High severity

  RUGGEDCOM ROX MX5000: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-40947May 12, 2026Siemens

  A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEDCOM ROX RX1400 (All versions < V2.17.1), RUGGEDCOM ROX RX1500 (All versions < V2.17.1), RUGGEDCOM ROX RX1501 (All versi

• 9.8 Critical severity

  OpenSSL: Out-of-bounds Write

  CVE-2025-15467Jan 27, 2026OpenSSLEPSS 74.8%

  Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote co

• 7.2 High severity

  RUGGEDCOM ROX MX5000: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2024-56840Dec 9, 2025Siemens

  A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (All versions < V2.17.0), RUGGEDCOM ROX RX1500 (All versions < V2.17.0), RUGGEDCOM ROX RX1501 (All versi

• 7.2 High severity

  RUGGEDCOM ROX MX5000: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2024-56839Dec 9, 2025Siemens

  A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (All versions < V2.17.0), RUGGEDCOM ROX RX1500 (All versions < V2.17.0), RUGGEDCOM ROX RX1501 (All versi

• 7.2 High severity

  RUGGEDCOM ROX MX5000: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2024-56838Dec 9, 2025Siemens

  A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (All versions < V2.17.0), RUGGEDCOM ROX RX1500 (All versions < V2.17.0), RUGGEDCOM ROX RX1501 (All versi

• 7.2 High severity

  RUGGEDCOM ROX MX5000: Improper Neutralization of Special Elements used in a Command

  CVE-2024-56837Dec 9, 2025Siemens

  A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (All versions < V2.17.0), RUGGEDCOM ROX RX1500 (All versions < V2.17.0), RUGGEDCOM ROX RX1501 (All versi

• 8.8 High severity

  RUGGEDCOM ROX MX5000: Improper Neutralization of Special Elements used in a Command

  CVE-2024-56836Dec 9, 2025Siemens

  A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (All versions < V2.17.0), RUGGEDCOM ROX RX1500 (All versions < V2.17.0), RUGGEDCOM ROX RX1501 (All versi

• 8.8 High severity

  RUGGEDCOM ROX MX5000: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2024-56835Dec 9, 2025Siemens

  A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (All versions < V2.17.0), RUGGEDCOM ROX RX1500 (All versions < V2.17.0), RUGGEDCOM ROX RX1501 (All versi

• 7.6 High severity

  RUGGEDCOM ROX MX5000: Authentication Bypass Using an Alternate Path or Channel

  CVE-2025-40761Aug 12, 2025Siemens

  A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions), RUGGEDCOM ROX MX5000RE (All versions), RUGGEDCOM ROX RX1400 (All versions), RUGGEDCOM ROX RX1500 (All versions), RUGGEDCOM ROX RX1501 (All versions), RUGGEDCOM ROX RX1510 (All versions

• 7.8 High severity

  libxml2: Use After Free

  CVE-2025-7425Jul 10, 2025GNOME

  A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attri

• 7.8 High severity

  Red Hat Enterprise Linux 10: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2025-6020Jun 17, 2025Red Hat

  A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.

• 9.1 Critical severity

  Red Hat Enterprise Linux 10: Out-of-bounds Read

  CVE-2025-49796Jun 16, 2025Red HatEPSS 1.63%

  A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of s

• 9.1 Critical severity

  Red Hat Enterprise Linux 10: Expired Pointer Dereference

  CVE-2025-49794Jun 16, 2025Red Hat

  A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML d

• 7.7 High severity

  RUGGEDCOM ROX MX5000: Client-Side Enforcement of Server-Side Security

  CVE-2025-40591Jun 10, 2025Siemens

  A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (All versions < V2.16.5), RUGGEDCOM ROX RX1501 (All versi

• 9.9 Critical severity

  RUGGEDCOM ROX MX5000: Client-Side Enforcement of Server-Side Security

  CVE-2025-33025May 13, 2025SiemensEPSS 1.26%

  A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (All versions < V2.16.5), RUGGEDCOM ROX RX1501 (All versi

• 9.9 Critical severity

  RUGGEDCOM ROX MX5000: Client-Side Enforcement of Server-Side Security

  CVE-2025-33024May 13, 2025SiemensEPSS 1.31%

  A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (All versions < V2.16.5), RUGGEDCOM ROX RX1501 (All versi

• 9.9 Critical severity

  RUGGEDCOM ROX MX5000: Client-Side Enforcement of Server-Side Security

  CVE-2025-32469May 13, 2025SiemensEPSS 1.31%

  A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (All versions < V2.16.5), RUGGEDCOM ROX RX1501 (All versi

• 7.8 High severity

  U-Boot: Integer Overflow or Wraparound

  CVE-2024-57258Feb 18, 2025Denx

  Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64.

• 9.8 Critical severity

  glib: Buffer Copy without Checking Size of Input

  CVE-2024-52533Nov 11, 2024GNOMEEPSS 1.51%

  gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character.

• 7.2 High severity

  RUGGEDCOM ROX MX5000: Improper Neutralization of Special Elements used in a Command

  CVE-2023-36755Jul 11, 2023Siemens

  A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versi

• 7.2 High severity

  RUGGEDCOM ROX MX5000: Improper Neutralization of Special Elements used in a Command

  CVE-2023-36754Jul 11, 2023SiemensEPSS 1.54%

  A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versi

• 7.2 High severity

  RUGGEDCOM ROX MX5000: Improper Neutralization of Special Elements used in a Command

  CVE-2023-36753Jul 11, 2023SiemensEPSS 1.54%

  A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versi

• 7.2 High severity

  RUGGEDCOM ROX MX5000: Improper Neutralization of Special Elements used in a Command

  CVE-2023-36752Jul 11, 2023SiemensEPSS 1.54%

  A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versi

• 7.2 High severity

  RUGGEDCOM ROX MX5000: Improper Neutralization of Special Elements used in a Command

  CVE-2023-36751Jul 11, 2023SiemensEPSS 1.54%

  A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versi

• 7.2 High severity

  RUGGEDCOM ROX MX5000: Improper Neutralization of Special Elements used in a Command

  CVE-2023-36750Jul 11, 2023SiemensEPSS 1.54%

  A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versi

• 7.4 High severity

  RUGGEDCOM ROX MX5000: Use of a Broken or Risky Cryptographic Algorithm

  CVE-2023-36749Jul 11, 2023Siemens

  A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versi

• 8.8 High severity

  RUGGEDCOM ROX MX5000: Cross-Site Request Forgery

  CVE-2022-29561Jul 11, 2023Siemens

  A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versi

• 7.8 High severity

  SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Out-of-bounds Write

  CVE-2023-29491Apr 14, 2023Siemens

  ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment va

• 7.1 High severity

  Uboot: Out-of-bounds Write

  CVE-2022-2347Sep 23, 2022Uboot

  There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physic

• 9.8 Critical severity

  SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Out-of-bounds Write

  CVE-2022-37434Aug 5, 2022SiemensEPSS 19.2%

  zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code

• 7.2 High severity

  RUGGEDCOM ROX MX5000: Improper Neutralization of Special Elements used in a Command

  CVE-2022-29560Jul 12, 2022SiemensEPSS 1.71%

  A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < 2.15.1), RUGGEDCOM ROX MX5000RE (All versions < 2.15.1), RUGGEDCOM ROX RX1400 (All versions < 2.15.1), RUGGEDCOM ROX RX1500 (All versions < 2.15.1), RUGGEDCOM ROX RX1501 (All versions

• 9.8 Critical severity

  RUGGEDCOM ROX MX5000: Out-of-bounds Write

  CVE-2022-34835Jun 30, 2022SiemensEPSS 2.28%

  In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md" command enables the corruption of the return address pointer of the do_i2c_md function.

• 7.5 High severity

  OpenSSL: Loop with Unreachable Exit Condition

  CVE-2022-0778Mar 15, 2022OpenSSLEPSS 73.2%

  The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or ex