CVE-2025-40935

mediumpriority · track · 0EPSS 0.002 · 15 %ileDEEUNLRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.25% (15th) EPSS

CVSS 4.3 · medium

Is it mine?

137 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-22

A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.10.1), RUGGEDCOM RS416Pv2 V5.X (All versions < V5.10.1), RUGGEDCOM RS416v2 V5.X (All versions < V5.10.1), RUGGEDCOM RS900 (32M) V5.X (All versions < V5.10.1), RUGGEDCOM RS900G (32M) V5.X (All versions < V5.10.1), RUGGEDCOM RSG2100 (32M) V5.X (All versions < V5.10.1), RUGGEDCOM RSG2100P (32M) V5.X (All versions < V5.10.1), RUGGEDCOM RSG2288 V5.X (All versions < V5.10.1), RUGGEDCOM RSG2300 V5.X (All versions < V5.10.1), RUGGEDCOM RSG2300P V5.X (All versions < V5.10.1), RUGGEDCOM RSG2488 V5.X (All versions < V5.10.1), RUGGEDCOM RSG907R (All versions < V5.10.1), RUGGEDCOM RSG908C (All versions < V5.10.1), RUGGEDCOM RSG909R (All versions < V5.10.1), RUGGEDCOM RSG910C (All versions < V5.10.1), RUGGEDCOM RSG920P V5.X (All versions < V5.10.1), RUGGEDCOM RSL910 (All versions < V5.10.1), RUGGEDCOM RST2228 (All versions < V5.10.1), RUGGEDCOM RST2228P (All versions < V5.10.1), RUGGEDCOM RST916C (All versions < V5.10.1), RUGGEDCOM RST916P (All versions < V5.10.1). Affected devices do not properly validate input during the TLS certificate upload process of the web service. This could allow an authenticated remote attacker to trigger a device crash and reboot, leading to a temporary Denial of Service on the device.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedRUGGEDCOM RMC8388 V5.Xsiemens_psirt
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RS416Pv2 V5.Xsiemens_psirt
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RS416v2 V5.Xsiemens_psirt
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RS900 (32M) V5.Xsiemens_psirt
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RS900G (32M) V5.Xsiemens_psirt
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSG2100 (32M) V5.Xsiemens_psirt
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSG2100P (32M) V5.Xsiemens_psirt
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSG2288 V5.Xsiemens_psirt
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSG2300 V5.Xsiemens_psirt
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSG2300P V5.Xsiemens_psirt
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSG2488 V5.Xsiemens_psirt
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSG907Rsiemens_psirt
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSG908Csiemens_psirt
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSG909Rsiemens_psirt
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSG910Csiemens_psirt
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSG920P V5.Xsiemens_psirt
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSL910siemens_psirt
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RST2228siemens_psirt
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RST2228Psiemens_psirt
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RST916Csiemens_psirt
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RST916Psiemens_psirt
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RMC8388 V5.Xcisa_csaf_ot
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RS416Pv2 V5.Xcisa_csaf_ot
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RS416v2 V5.Xcisa_csaf_ot
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RS900 (32M) V5.Xcisa_csaf_ot
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RS900G (32M) V5.Xcisa_csaf_ot
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSG2100 (32M) V5.Xcisa_csaf_ot
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSG2100P (32M) V5.Xcisa_csaf_ot
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSG2288 V5.Xcisa_csaf_ot
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSG2300 V5.Xcisa_csaf_ot
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSG2300P V5.Xcisa_csaf_ot
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSG2488 V5.Xcisa_csaf_ot
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSG907Rcisa_csaf_ot
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSG908Ccisa_csaf_ot
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSG909Rcisa_csaf_ot
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSG910Ccisa_csaf_ot
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSG920P V5.Xcisa_csaf_ot
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RSL910cisa_csaf_ot
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RST2228cisa_csaf_ot
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RST2228Pcisa_csaf_ot
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RST916Ccisa_csaf_ot
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/
FixedRUGGEDCOM RST916Pcisa_csaf_ot
Update to V5.10.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109997649/

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.3–5.3

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Lsecondary · NCSC-NL NL

v3.14.3mediumAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Lsecondary · FSTEC (BDU) RU

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Lsecondary · productcert@siemens.com DEexploitability 2.8 · impact 1.4

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Lsecondary · Siemens ProductCERT DE

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Lsecondary · CISA US

v4.05.3mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.05.3mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · productcert@siemens.com DE

v4.01.3lowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-20USCWE-20USCWE-20USCWE-20US

affected products (137)

Products and version ranges known to be affected.

RUGGEDCOM RMC8388 V5.Xall versionscisa_csaf_otUS
RUGGEDCOM RS416Pv2 V5.Xall versionscisa_csaf_otUS
RUGGEDCOM RS416v2 V5.Xall versionscisa_csaf_otUS
RUGGEDCOM RS900 (32M) V5.Xall versionscisa_csaf_otUS
RUGGEDCOM RS900G (32M) V5.Xall versionscisa_csaf_otUS
RUGGEDCOM RSG2100 (32M) V5.Xall versionscisa_csaf_otUS
RUGGEDCOM RSG2100P (32M) V5.Xall versionscisa_csaf_otUS
RUGGEDCOM RSG2288 V5.Xall versionscisa_csaf_otUS
RUGGEDCOM RSG2300 V5.Xall versionscisa_csaf_otUS
RUGGEDCOM RSG2300P V5.Xall versionscisa_csaf_otUS
RUGGEDCOM RSG2488 V5.Xall versionscisa_csaf_otUS
RUGGEDCOM RSG907Rall versionscisa_csaf_otUS
RUGGEDCOM RSG908Call versionscisa_csaf_otUS
RUGGEDCOM RSG909Rall versionscisa_csaf_otUS
RUGGEDCOM RSG910Call versionscisa_csaf_otUS
RUGGEDCOM RSG920P V5.Xall versionscisa_csaf_otUS
RUGGEDCOM RSL910all versionscisa_csaf_otUS
RUGGEDCOM RST2228all versionscisa_csaf_otUS
RUGGEDCOM RST2228Pall versionscisa_csaf_otUS
RUGGEDCOM RST916Call versionscisa_csaf_otUS

showing 20 of 137

advisories (3)

Vendor and ecosystem advisories describing this.

NCSC-2025-0382Kwetsbaarheden verholpen in Siemens productenNL2025-12-09csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten als Building X, COMOS, Energy Services, Gridscale X, NX, RUGGEDCOM, SICAM, SIMATIC, SINEC, SINEMA, SIPLUS en Solid Edge.
SSA-763474SSA-763474: Denial of Service Vulnerability in Ruggedcom ROS devices before V5.10.12025-12-09csaf · siemens_psirtDE
Ruggedcom ROS devices contain a temporary denial of service vulnerability that could allow an attacker to crash and restart the device. Siemens has released new versions for the affected products and recommends to update to the latest versions.
ICSA-26-015-05Siemens RUGGEDCOM ROS2025-12-09icsa · cisa_csaf_otUS
Ruggedcom ROS devices contain a temporary denial of service vulnerability that could allow an attacker to crash and restart the device. Siemens has released new versions for the affected products and recommends to update to the latest versions.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot ncsc_nl siemens_psirt NVD CVE.org MITRE

published 2025-12-09modified 2026-10-07

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan