Three Chained Zero-Day Vulnerabilities in Siemens RUGGEDCOM ROX II: Full Breakdown

Affected devices and firmware versions

All devices in the RUGGEDCOM ROX II family running firmware versions prior to V2.17.1 are affected. The specific models are:

• RUGGEDCOM ROX MX5000
• RUGGEDCOM ROX MX5000RE
• RUGGEDCOM ROX RX1400
• RUGGEDCOM ROX RX1500
• RUGGEDCOM ROX RX1501
• RUGGEDCOM ROX RX1510
• RUGGEDCOM ROX RX1511
• RUGGEDCOM ROX RX1512
• RUGGEDCOM ROX RX1524
• RUGGEDCOM ROX RX1536
• RUGGEDCOM ROX RX5000

All of these are confirmed affected for all three CVEs at versions below V2.17.1 .

Remediation: what Siemens has released

Siemens published security advisory SSA-577017 on May 12, 2026, and has released firmware V2.17.1 for the entire RUGGEDCOM ROX II family . The remediation is to update to V2.17.1 or later via Siemens Industry Online Support .

CISA also issued an advisory on May 14, 2026, urging operators to apply the firmware update . For the related RUGGEDCOM APE1808 device, Siemens advises contacting customer support to receive patch and update information .

Broader implications for critical infrastructure security

• OT network backbone exposure. RUGGEDCOM ROX switches sit at the network core of substations, pipeline control systems, and industrial networks. Full root-level compromise of these devices could allow an attacker to disrupt, manipulate, or monitor industrial processes at scale .
• Chained exploit lowers the skill barrier. Rather than requiring a single critical vulnerability, this three-step chain lets an attacker escalate from file reading to persistent root access. This modular attack pattern is increasingly common in OT-targeted campaigns .
• Widespread installed base. The vulnerability spans 11 device models deployed globally across energy, manufacturing, water, and transportation sectors. Many of these devices are in environments with long patch cycles and limited network segmentation .
• Accelerating patch burden for NIS2-regulated operators. Between August and December 2025 alone, Siemens issued six critical OT advisories. The compounding vulnerability volume is straining asset owners who must maintain availability while patching deeply embedded network gear .
• Third-party dependency risk. In addition to the three zero-days, Siemens advisory SSA-577017 bundles dozens of third-party vulnerabilities (including U-Boot bootloader flaws) that are also remediated in V2.17.1, underscoring how supply-chain software composition affects OT device security .

No evidence of active exploitation in the wild has been published as of July 18, 2026, but Unit 42 emphasizes that attackers with network access to the management interface could weaponize this chain remotely .