Siemens RUGGEDCOM ROX II Dynamic DNS Configuration Vulnerability Allowing Reverse Shell and Root Access

A command injection vulnerability has been identified in the Siemens RUGGEDCOM ROX II family, affecting all versions prior to 2.17.0. During the Dynamic DNS configuration, it is possible to inject additional parameters, which under certain circumstances could be exploited to spawn a reverse shell and gain root access on the affected system.

Impact

Exploitation of this vulnerability could lead to unauthorized access with root privileges, allowing an attacker to execute commands as the root user and potentially manipulate the system at a fundamental level.

Remediation

Users are advised to update to version 2.17.0 or later. Additional information can be found on the Siemens Industry Support page.