CVE-2025-40948

The record

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEDCOM ROX RX1400 (All versions < V2.17.1), RUGGEDCOM ROX RX1500 (All versions < V2.17.1), RUGGEDCOM ROX RX1501 (All versions < V2.17.1), RUGGEDCOM ROX RX1510 (All versions < V2.17.1), RUGGEDCOM ROX RX1511 (All versions < V2.17.1), RUGGEDCOM ROX RX1512 (All versions < V2.17.1), RUGGEDCOM ROX RX1524 (All versions < V2.17.1), RUGGEDCOM ROX RX1536 (All versions < V2.17.1), RUGGEDCOM ROX RX5000 (All versions < V2.17.1). Affected devices do not properly validate input in the web server's JSON-RPC interface. This could allow an authenticated remote attacker to read arbitrary files from the underlying operating system's filesystem with root privileges.

Affected packages

Related vulnerabilities

• CVE-2026-112944 launch-editor allows users to open files with line numbers in editor from Node.js. CWE-88
• CVE-2026-112900 Pillow is a Python imaging library. CWE-88
• CVE-2026-105326 An argument injection flaw was found in CUPS. CWE-88
• CVE-2026-102827 simple-git, an interface for running git commands in any node.js application, enables… CWE-88
• CVE-2026-89066 Improper neutralization of special elements used in an OS command in the task synthesis… CWE-88
• CVE-2026-11765 Improper neutralization of argument delimiters in a command ('argument injection')… CWE-88
• CVE-2026-0304 A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables… CWE-88
• CVE-2026-8044 CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument… CWE-88