Overview
This report provides an in-depth analysis of the recently discovered security vulnerability, CVE-2025-40591, which affects multiple versions of RUGGEDCOM ROX devices. This vulnerability, when exploited, could potentially lead to system compromise or data leakage, making it a serious issue for businesses using these devices. The vulnerability is particularly critical due to its ability to grant root privileges and disclose file system contents to an authenticated remote attacker.
Vulnerability Summary
CVE ID: CVE-2025-40591
Severity: High (CVSS 7.7)
Attack Vector: Network
Privileges Required: Low (Authenticated user)
User Interaction: None
Impact: System compromise and potential data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
RUGGEDCOM ROX MX5000 | All versions < V2.16.5 RUGGEDCOM ROX MX5000RE | All versions < V2.16.5 RUGGEDCOM ROX RX1400 | All versions < V2.16.5 RUGGEDCOM ROX RX1500 | All versions < V2.16.5 RUGGEDCOM ROX RX1510 | All versions < V2.16.5 RUGGEDCOM ROX RX1511 | All versions < V2.16.5 RUGGEDCOM ROX RX1524 | All versions < V2.16.5 RUGGEDCOM ROX RX1536 | All versions < V2.16.5 RUGGEDCOM ROX RX5000 | All versions < V2.16.5 How the Exploit Works
The vulnerability stems from the ‘Log Viewers’ tool in the web interface of the affected devices. Due to missing server-side input sanitation, an authenticated remote attacker can exploit this vulnerability by injecting malicious commands. This allows the attacker to execute the ‘tail’ command with root privileges, thereby disclosing the contents of all files in the filesystem.
Conceptual Example Code
The following conceptual example demonstrates how an authenticated attacker might exploit this vulnerability:
POST /log_viewer HTTP/1.1
Host: affected_device_ip
Content-Type: application/json
Authorization: Bearer <auth_token>
{ "command": "; tail -n 100 /etc/passwd;" }In the example above, the attacker injects a malicious ‘tail’ command into the ‘command’ parameter of a POST request to the ‘/log_viewer’ endpoint, and as a result, the contents of the ‘/etc/passwd’ file are returned in the response, revealing sensitive information.
