SSA-577017

Siemens Security Advisory by Siemens ProductCERT

SSA-577017: Multiple Vulnerabilities in Ruggedcom Rox Before 2.17.1

Publication Date:	2026-05-12
Last Update:	2026-05-12
Current Version:	V1.0
CVSS v3.1 Base Score:	9.8

SUMMARY

Ruggedcom Rox before v2.17.1 contain multiple third-party vulnerabilities.

Siemens has released new versions for the affected products and recommends to update to the latest versions.

KNOWN AFFECTED PRODUCTS

Un-/Collapse All

Affected Product and Versions	Remediation
RUGGEDCOM ROX II family	Show more details
RUGGEDCOM ROX MX5000 All versions < V2.17.1 affected by all CVEs CVE-2025-0395 CVE-2025-3576 CVE-2025-7425 CVE-2025-9714 CVE-2025-49794 CVE-2025-49796 CVE-2025-46836 CVE-2024-22365 CVE-2025-6020 CVE-2023-27043 CVE-2024-3447 CVE-2023-3019 CVE-2024-57256 CVE-2024-57258 CVE-2022-34835 CVE-2022-30790 CVE-2022-30552 CVE-2022-2347 CVE-2020-10648 CVE-2019-14200 CVE-2019-14201 CVE-2019-14202 CVE-2019-14203 CVE-2019-14204 CVE-2019-14197 CVE-2019-14192 CVE-2019-14193 CVE-2019-14199 CVE-2019-14194 CVE-2019-14198 CVE-2019-14196 CVE-2019-14195 CVE-2019-13106 CVE-2019-13104 CVE-2019-13103	Update to V2.17.1 or later version https://support.industry.siemens.com/cs/ww/en/view/110002017/
RUGGEDCOM ROX MX5000RE All versions < V2.17.1 affected by all CVEs CVE-2025-0395 CVE-2025-3576 CVE-2025-7425 CVE-2025-9714 CVE-2025-49794 CVE-2025-49796 CVE-2025-46836 CVE-2024-22365 CVE-2025-6020 CVE-2023-27043 CVE-2024-3447 CVE-2023-3019 CVE-2024-57256 CVE-2024-57258 CVE-2022-34835 CVE-2022-30790 CVE-2022-30552 CVE-2022-2347 CVE-2020-10648 CVE-2019-14200 CVE-2019-14201 CVE-2019-14202 CVE-2019-14203 CVE-2019-14204 CVE-2019-14197 CVE-2019-14192 CVE-2019-14193 CVE-2019-14199 CVE-2019-14194 CVE-2019-14198 CVE-2019-14196 CVE-2019-14195 CVE-2019-13106 CVE-2019-13104 CVE-2019-13103	Update to V2.17.1 or later version https://support.industry.siemens.com/cs/ww/en/view/110002017/
RUGGEDCOM ROX RX1400 All versions < V2.17.1 affected by all CVEs CVE-2025-0395 CVE-2025-3576 CVE-2025-7425 CVE-2025-9714 CVE-2025-49794 CVE-2025-49796 CVE-2025-46836 CVE-2024-22365 CVE-2025-6020 CVE-2023-27043 CVE-2024-3447 CVE-2023-3019 CVE-2024-57256 CVE-2024-57258 CVE-2022-34835 CVE-2022-30790 CVE-2022-30552 CVE-2022-2347 CVE-2020-10648 CVE-2019-14200 CVE-2019-14201 CVE-2019-14202 CVE-2019-14203 CVE-2019-14204 CVE-2019-14197 CVE-2019-14192 CVE-2019-14193 CVE-2019-14199 CVE-2019-14194 CVE-2019-14198 CVE-2019-14196 CVE-2019-14195 CVE-2019-13106 CVE-2019-13104 CVE-2019-13103	Update to V2.17.1 or later version https://support.industry.siemens.com/cs/ww/en/view/110002017/
RUGGEDCOM ROX RX1500 All versions < V2.17.1 affected by all CVEs CVE-2025-0395 CVE-2025-3576 CVE-2025-7425 CVE-2025-9714 CVE-2025-49794 CVE-2025-49796 CVE-2025-46836 CVE-2024-22365 CVE-2025-6020 CVE-2023-27043 CVE-2024-3447 CVE-2023-3019 CVE-2024-57256 CVE-2024-57258 CVE-2022-34835 CVE-2022-30790 CVE-2022-30552 CVE-2022-2347 CVE-2020-10648 CVE-2019-14200 CVE-2019-14201 CVE-2019-14202 CVE-2019-14203 CVE-2019-14204 CVE-2019-14197 CVE-2019-14192 CVE-2019-14193 CVE-2019-14199 CVE-2019-14194 CVE-2019-14198 CVE-2019-14196 CVE-2019-14195 CVE-2019-13106 CVE-2019-13104 CVE-2019-13103	Update to V2.17.1 or later version https://support.industry.siemens.com/cs/ww/en/view/110002017/
RUGGEDCOM ROX RX1501 All versions < V2.17.1 affected by all CVEs CVE-2025-0395 CVE-2025-3576 CVE-2025-7425 CVE-2025-9714 CVE-2025-49794 CVE-2025-49796 CVE-2025-46836 CVE-2024-22365 CVE-2025-6020 CVE-2023-27043 CVE-2024-3447 CVE-2023-3019 CVE-2024-57256 CVE-2024-57258 CVE-2022-34835 CVE-2022-30790 CVE-2022-30552 CVE-2022-2347 CVE-2020-10648 CVE-2019-14200 CVE-2019-14201 CVE-2019-14202 CVE-2019-14203 CVE-2019-14204 CVE-2019-14197 CVE-2019-14192 CVE-2019-14193 CVE-2019-14199 CVE-2019-14194 CVE-2019-14198 CVE-2019-14196 CVE-2019-14195 CVE-2019-13106 CVE-2019-13104 CVE-2019-13103	Update to V2.17.1 or later version https://support.industry.siemens.com/cs/ww/en/view/110002017/
RUGGEDCOM ROX RX1510 All versions < V2.17.1 affected by all CVEs CVE-2025-0395 CVE-2025-3576 CVE-2025-7425 CVE-2025-9714 CVE-2025-49794 CVE-2025-49796 CVE-2025-46836 CVE-2024-22365 CVE-2025-6020 CVE-2023-27043 CVE-2024-3447 CVE-2023-3019 CVE-2024-57256 CVE-2024-57258 CVE-2022-34835 CVE-2022-30790 CVE-2022-30552 CVE-2022-2347 CVE-2020-10648 CVE-2019-14200 CVE-2019-14201 CVE-2019-14202 CVE-2019-14203 CVE-2019-14204 CVE-2019-14197 CVE-2019-14192 CVE-2019-14193 CVE-2019-14199 CVE-2019-14194 CVE-2019-14198 CVE-2019-14196 CVE-2019-14195 CVE-2019-13106 CVE-2019-13104 CVE-2019-13103	Update to V2.17.1 or later version https://support.industry.siemens.com/cs/ww/en/view/110002017/
RUGGEDCOM ROX RX1511 All versions < V2.17.1 affected by all CVEs CVE-2025-0395 CVE-2025-3576 CVE-2025-7425 CVE-2025-9714 CVE-2025-49794 CVE-2025-49796 CVE-2025-46836 CVE-2024-22365 CVE-2025-6020 CVE-2023-27043 CVE-2024-3447 CVE-2023-3019 CVE-2024-57256 CVE-2024-57258 CVE-2022-34835 CVE-2022-30790 CVE-2022-30552 CVE-2022-2347 CVE-2020-10648 CVE-2019-14200 CVE-2019-14201 CVE-2019-14202 CVE-2019-14203 CVE-2019-14204 CVE-2019-14197 CVE-2019-14192 CVE-2019-14193 CVE-2019-14199 CVE-2019-14194 CVE-2019-14198 CVE-2019-14196 CVE-2019-14195 CVE-2019-13106 CVE-2019-13104 CVE-2019-13103	Update to V2.17.1 or later version https://support.industry.siemens.com/cs/ww/en/view/110002017/
RUGGEDCOM ROX RX1512 All versions < V2.17.1 affected by all CVEs CVE-2025-0395 CVE-2025-3576 CVE-2025-7425 CVE-2025-9714 CVE-2025-49794 CVE-2025-49796 CVE-2025-46836 CVE-2024-22365 CVE-2025-6020 CVE-2023-27043 CVE-2024-3447 CVE-2023-3019 CVE-2024-57256 CVE-2024-57258 CVE-2022-34835 CVE-2022-30790 CVE-2022-30552 CVE-2022-2347 CVE-2020-10648 CVE-2019-14200 CVE-2019-14201 CVE-2019-14202 CVE-2019-14203 CVE-2019-14204 CVE-2019-14197 CVE-2019-14192 CVE-2019-14193 CVE-2019-14199 CVE-2019-14194 CVE-2019-14198 CVE-2019-14196 CVE-2019-14195 CVE-2019-13106 CVE-2019-13104 CVE-2019-13103	Update to V2.17.1 or later version https://support.industry.siemens.com/cs/ww/en/view/110002017/
RUGGEDCOM ROX RX1524 All versions < V2.17.1 affected by all CVEs CVE-2025-0395 CVE-2025-3576 CVE-2025-7425 CVE-2025-9714 CVE-2025-49794 CVE-2025-49796 CVE-2025-46836 CVE-2024-22365 CVE-2025-6020 CVE-2023-27043 CVE-2024-3447 CVE-2023-3019 CVE-2024-57256 CVE-2024-57258 CVE-2022-34835 CVE-2022-30790 CVE-2022-30552 CVE-2022-2347 CVE-2020-10648 CVE-2019-14200 CVE-2019-14201 CVE-2019-14202 CVE-2019-14203 CVE-2019-14204 CVE-2019-14197 CVE-2019-14192 CVE-2019-14193 CVE-2019-14199 CVE-2019-14194 CVE-2019-14198 CVE-2019-14196 CVE-2019-14195 CVE-2019-13106 CVE-2019-13104 CVE-2019-13103	Update to V2.17.1 or later version https://support.industry.siemens.com/cs/ww/en/view/110002017/
RUGGEDCOM ROX RX1536 All versions < V2.17.1 affected by all CVEs CVE-2025-0395 CVE-2025-3576 CVE-2025-7425 CVE-2025-9714 CVE-2025-49794 CVE-2025-49796 CVE-2025-46836 CVE-2024-22365 CVE-2025-6020 CVE-2023-27043 CVE-2024-3447 CVE-2023-3019 CVE-2024-57256 CVE-2024-57258 CVE-2022-34835 CVE-2022-30790 CVE-2022-30552 CVE-2022-2347 CVE-2020-10648 CVE-2019-14200 CVE-2019-14201 CVE-2019-14202 CVE-2019-14203 CVE-2019-14204 CVE-2019-14197 CVE-2019-14192 CVE-2019-14193 CVE-2019-14199 CVE-2019-14194 CVE-2019-14198 CVE-2019-14196 CVE-2019-14195 CVE-2019-13106 CVE-2019-13104 CVE-2019-13103	Update to V2.17.1 or later version https://support.industry.siemens.com/cs/ww/en/view/110002017/
RUGGEDCOM ROX RX5000 All versions < V2.17.1 affected by all CVEs CVE-2025-0395 CVE-2025-3576 CVE-2025-7425 CVE-2025-9714 CVE-2025-49794 CVE-2025-49796 CVE-2025-46836 CVE-2024-22365 CVE-2025-6020 CVE-2023-27043 CVE-2024-3447 CVE-2023-3019 CVE-2024-57256 CVE-2024-57258 CVE-2022-34835 CVE-2022-30790 CVE-2022-30552 CVE-2022-2347 CVE-2020-10648 CVE-2019-14200 CVE-2019-14201 CVE-2019-14202 CVE-2019-14203 CVE-2019-14204 CVE-2019-14197 CVE-2019-14192 CVE-2019-14193 CVE-2019-14199 CVE-2019-14194 CVE-2019-14198 CVE-2019-14196 CVE-2019-14195 CVE-2019-13106 CVE-2019-13104 CVE-2019-13103	Update to V2.17.1 or later version https://support.industry.siemens.com/cs/ww/en/view/110002017/

MITIGATIONS

Product-specific remediations or mitigations can be found in the section Known Affected Products.
Please follow the General Security Recommendations.

GENERAL SECURITY RECOMMENDATIONS

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

PRODUCT DESCRIPTION

RUGGEDCOM Ethernet switches are used to operate reliably in electrical harsh and climatically demanding environments such as electric utility substations and traffic control cabinets.

VULNERABILITY DESCRIPTION

Un-/Collapse All

This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.

Vulnerability CVE-2019-13103

A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data.

CVSS v3.1 Base Score	7.1
CVSS v3.1 Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CWE	CWE-674: Uncontrolled Recursion

Vulnerability CVE-2019-13104

In Das U-Boot versions 2016.11-rc1 through 2019.07-rc4, an underflow can cause memcpy() to overwrite a very large amount of data (including the whole stack) while reading a crafted ext4 filesystem.

CVSS v3.1 Base Score	7.8
CVSS v3.1 Vector	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE	CWE-191: Integer Underflow (Wrap or Wraparound)

Vulnerability CVE-2019-13106

Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a crafted ext4 filesystem, which results in a stack buffer overflow and likely code execution.

CVSS v3.1 Base Score	7.8
CVSS v3.1 Vector	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE	CWE-787: Out-of-bounds Write

Vulnerability CVE-2019-14192

An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet integer underflow during an nc_input_packet call.

CVSS v3.1 Base Score	9.8
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE	CWE-191: Integer Underflow (Wrap or Wraparound)

Vulnerability CVE-2019-14193

An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with an unvalidated length at nfs_readlink_reply, in the "if" block after calculating the new path length.

CVSS v3.1 Base Score	9.8
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE	CWE-787: Out-of-bounds Write

Vulnerability CVE-2019-14194

An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_read_reply when calling store_block in the NFSv2 case.

CVSS v3.1 Base Score	9.8
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE	CWE-787: Out-of-bounds Write

Vulnerability CVE-2019-14195

An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with unvalidated length at nfs_readlink_reply in the "else" block after calculating the new path length.

CVSS v3.1 Base Score	9.8
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE	CWE-787: Out-of-bounds Write

Vulnerability CVE-2019-14196

An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_lookup_reply.

CVSS v3.1 Base Score	9.8
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE	CWE-787: Out-of-bounds Write

Vulnerability CVE-2019-14197

An issue was discovered in Das U-Boot through 2019.07. There is a read of out-of-bounds data at nfs_read_reply.

CVSS v3.1 Base Score	9.1
CVSS v3.1 Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CWE	CWE-125: Out-of-bounds Read

Vulnerability CVE-2019-14198

An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_read_reply when calling store_block in the NFSv3 case.

CVSS v3.1 Base Score	9.8
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE	CWE-787: Out-of-bounds Write

Vulnerability CVE-2019-14199

An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet integer underflow during an *udp_packet_handler call.

CVSS v3.1 Base Score	9.8
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE	CWE-191: Integer Underflow (Wrap or Wraparound)

Vulnerability CVE-2019-14200

An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: rpc_lookup_reply.

CVSS v3.1 Base Score	9.8
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE	CWE-787: Out-of-bounds Write

Vulnerability CVE-2019-14201

An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_lookup_reply.

CVSS v3.1 Base Score	9.8
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE	CWE-787: Out-of-bounds Write

Vulnerability CVE-2019-14202

An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_readlink_reply.

CVSS v3.1 Base Score	9.8
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE	CWE-787: Out-of-bounds Write

Vulnerability CVE-2019-14203

An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_mount_reply.

CVSS v3.1 Base Score	9.8
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE	CWE-787: Out-of-bounds Write

Vulnerability CVE-2019-14204

An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_umountall_reply.

CVSS v3.1 Base Score	9.8
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE	CWE-787: Out-of-bounds Write

Vulnerability CVE-2020-10648

Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a system configured to boot the default configuration.

CVSS v3.1 Base Score	7.8
CVSS v3.1 Vector	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE	CWE-20: Improper Input Validation

Vulnerability CVE-2022-2347

There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a wLength greater than 4096 bytes, they can write beyond the heap-allocated request buffer.

CVSS v3.1 Base Score	7.7
CVSS v3.1 Vector	CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE	CWE-122: Heap-based Buffer Overflow

Vulnerability CVE-2022-30552

Das U-Boot 2022.01 has a Buffer Overflow.

CVSS v3.1 Base Score	5.5
CVSS v3.1 Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE	CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Vulnerability CVE-2022-30790

Das U-Boot 2022.01 has a Buffer Overflow, a different issue than CVE-2022-30552.

CVSS v3.1 Base Score	7.8
CVSS v3.1 Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE	CWE-787: Out-of-bounds Write

Vulnerability CVE-2022-34835

In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md" command enables the corruption of the return address pointer of the do_i2c_md function.

CVSS v3.1 Base Score	9.8
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE	CWE-787: Out-of-bounds Write

Vulnerability CVE-2023-3019

A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.

CVSS v3.1 Base Score	6.0
CVSS v3.1 Vector	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
CWE	CWE-416: Use After Free

Vulnerability CVE-2023-27043

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

CVSS v3.1 Base Score	5.3
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE	CWE-1286: Improper Validation of Syntactic Correctness of Input

Vulnerability CVE-2024-3447

A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both s->data_count and the size of s->fifo_buffer are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.

CVSS v3.1 Base Score	6.0
CVSS v3.1 Vector	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
CWE	CWE-122: Heap-based Buffer Overflow

Vulnerability CVE-2024-22365

linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.

CVSS v3.1 Base Score	5.5
CVSS v3.1 Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE	CWE-664: Improper Control of a Resource Through its Lifetime

Vulnerability CVE-2024-57256

An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (adding one to an le32 variable) via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite.

CVSS v3.1 Base Score	7.1
CVSS v3.1 Vector	CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE	CWE-190: Integer Overflow or Wraparound

Vulnerability CVE-2024-57258

Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64.

CVSS v3.1 Base Score	7.1
CVSS v3.1 Vector	CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE	CWE-190: Integer Overflow or Wraparound

Vulnerability CVE-2025-0395

When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.

CVSS v3.1 Base Score	6.2
CVSS v3.1 Vector	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE	CWE-131: Incorrect Calculation of Buffer Size

Vulnerability CVE-2025-3576

A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.

CVSS v3.1 Base Score	5.9
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE	CWE-328: Use of Weak Hash

Vulnerability CVE-2025-6020

A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.

CVSS v3.1 Base Score	7.8
CVSS v3.1 Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE	CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Vulnerability CVE-2025-7425

A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.

CVSS v3.1 Base Score	7.8
CVSS v3.1 Vector	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
CWE	CWE-416: Use After Free

Vulnerability CVE-2025-9714

Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions xmlXPathRunEval, xmlXPathCtxtCompile, and xmlXPathEvalExpr were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.

CVSS v3.1 Base Score	6.2
CVSS v3.1 Vector	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE	CWE-674: Uncontrolled Recursion

Vulnerability CVE-2025-46836

net-tools is a collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Inn versions up to and including 2.10, the Linux network utilities (like ifconfig) from the net-tools package do not properly validate the structure of /proc files when showing interfaces. get_name() in interface.c copies interface labels from /proc/net/dev into a fixed 16-byte stack buffer without bounds checking, leading to possible arbitrary code execution or crash. The known attack path does not require privilege but also does not provide privilege escalation in this scenario. A patch is available and expected to be part of version 2.20.

CVSS v3.1 Base Score	6.6
CVSS v3.1 Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CWE	CWE-121: Stack-based Buffer Overflow

Vulnerability CVE-2025-49794

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.

CVSS v3.1 Base Score	9.1
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CWE	CWE-825: Expired Pointer Dereference

Vulnerability CVE-2025-49796

A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.

CVSS v3.1 Base Score	9.1
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CWE	CWE-125: Out-of-bounds Read

ADDITIONAL INFORMATION

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

HISTORY DATA

V1.0 (2026-05-12):

Publication Date

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.