The RUGGEDCOM ROX devices expose a command injection vulnerability within their web interface’s component. Because user‑supplied input is not properly sanitized, an authenticated attacker who can access the Scheduler can inject arbitrary operating system commands. This flaw is a type‑III command injection (CWE‑78) that, when exploited, allows the attacker to run commands with root privileges on the underlying operating system, compromising confidentiality, integrity, availability, and overall system control.

Affected are Siemens RUGGEDCOM ROX devices, specifically the MX5000, MX5000RE, RX1400, RX1500–RX1501, RX1510–RX1512, RX1524, RX1536, and RX5000 models, all firmware versions prior to V2.17.1.

The flaw has a CVSS score of 8.9, indicating high severity, but EPSS is not available, and the vulnerability is not yet in the CISA KEV catalog. Given that it requires authenticated remote access via the web interface, the likelihood of exploitation in a targeted environment is significant. An attacker would need valid user credentials, but once authenticated can execute any command with root privileges.