This vulnerability (CVE-2025-40947) involves improper neutralization of special elements used in OS commands (CWE-78) in Siemens RUGGEDCOM ROX MX5000 series devices before version 2.17.1. Specifically, during the feature key installation process, user-supplied input is not properly sanitized, enabling an authenticated remote attacker to inject arbitrary OS commands. Successful exploitation results in remote code execution with root privileges on the affected device. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

An authenticated remote attacker can execute arbitrary commands with root privileges on affected Siemens RUGGEDCOM ROX MX5000 devices. This could lead to full compromise of the device, including unauthorized control, data manipulation, or disruption of device operations. The vulnerability affects all versions prior to V2.17.1 across multiple RUGGEDCOM ROX MX5000 series models.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the feature key installation interface to trusted personnel only and monitor for unauthorized access attempts. Avoid exposing affected devices directly to untrusted networks. Siemens has not provided an official remediation level or patch link at this time.