Siemens RUGGEDCOM ROX II Command Injection Vulnerability in Traceroute Tool Allowing Privileged Code Execution

A command injection vulnerability has been identified in the web interface of several RUGGEDCOM ROX II devices, all versions prior to 2.16.5. The vulnerability arises from inadequate server-side input validation in the 'traceroute' tool, allowing authenticated remote attackers to execute arbitrary code with root privileges on the affected devices.

Impact

Exploitation of this vulnerability could lead to authenticated remote attackers executing arbitrary code with root privileges on the affected devices.

Remediation

Users are advised to update to version 2.16.5 or later. For more information, visit the Siemens Industry Support page.