CVE-2025-41224

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.10.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.10.0), RUGGEDCOM RS416NCv2 V5.X (All versions < V5.10.0), RUGGEDCOM RS416PNCv2 V5.X (All versions < V5.10.0), RUGGEDCOM RS416Pv2 V5.X (All versions < V5.10.0), RUGGEDCOM RS416v2 V5.X (All versions < V5.10.0), RUGGEDCOM RS900 (32M) V5.X (All versions < V5.10.0), RUGGEDCOM RS900G (32M) V5.X (All versions < V5.10.0), RUGGEDCOM RS900GNC(32M) V5.X (All versions < V5.10.0), RUGGEDCOM RS900NC(32M) V5.X (All versions < V5.10.0), RUGGEDCOM RSG2100 (32M) V5.X (All versions < V5.10.0), RUGGEDCOM RSG2100NC(32M) V5.X (All versions < V5.10.0), RUGGEDCOM RSG2100P (32M) V5.X (All versions < V5.10.0), RUGGEDCOM RSG2100PNC (32M) V5.X (All versions < V5.10.0), RUGGEDCOM RSG2288 V5.X (All versions < V5.10.0), RUGGEDCOM RSG2288NC V5.X (All versions < V5.10.0), RUGGEDCOM RSG2300 V5.X (All versions < V5.10.0), RUGGEDCOM RSG2300NC V5.X (All versions < V5.10.0), RUGGEDCOM RSG2300P V5.X (All versions < V5.10.0), RUGGEDCOM RSG2300PNC V5.X (All versions < V5.10.0), RUGGEDCOM RSG2488 V5.X (All versions < V5.10.0), RUGGEDCOM RSG2488NC V5.X (All versions < V5.10.0), RUGGEDCOM RSG907R (All versions < V5.10.0), RUGGEDCOM RSG908C (All versions < V5.10.0), RUGGEDCOM RSG909R (All versions < V5.10.0), RUGGEDCOM RSG910C (All versions < V5.10.0), RUGGEDCOM RSG920P V5.X (All versions < V5.10.0), RUGGEDCOM RSG920PNC V5.X (All versions < V5.10.0), RUGGEDCOM RSL910 (All versions < V5.10.0), RUGGEDCOM RSL910NC (All versions < V5.10.0), RUGGEDCOM RST2228 (All versions < V5.10.0), RUGGEDCOM RST2228P (All versions < V5.10.0), RUGGEDCOM RST916C (All versions < V5.10.0), RUGGEDCOM RST916P (All versions < V5.10.0). The affected products do not properly enforce interface access restrictions when changing from management to non-management interface configurations until a system reboot occurs, despite configuration being saved. This could allow an attacker with network access and credentials to gain access to device through non-management and maintain SSH access to the device until reboot.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-693

Affected software

VendorProductVersions
SiemensRUGGEDCOM RMC8388 V5.X< V5.10.0
SiemensRUGGEDCOM RMC8388NC V5.X< V5.10.0
SiemensRUGGEDCOM RS416NCv2 V5.X< V5.10.0
SiemensRUGGEDCOM RS416PNCv2 V5.X< V5.10.0
SiemensRUGGEDCOM RS416Pv2 V5.X< V5.10.0
SiemensRUGGEDCOM RS416v2 V5.X< V5.10.0
SiemensRUGGEDCOM RS900 (32M) V5.X< V5.10.0
SiemensRUGGEDCOM RS900G (32M) V5.X< V5.10.0
SiemensRUGGEDCOM RS900GNC(32M) V5.X< V5.10.0
SiemensRUGGEDCOM RS900NC(32M) V5.X< V5.10.0
SiemensRUGGEDCOM RSG2100 (32M) V5.X< V5.10.0
SiemensRUGGEDCOM RSG2100NC(32M) V5.X< V5.10.0
SiemensRUGGEDCOM RSG2100P (32M) V5.X< V5.10.0
SiemensRUGGEDCOM RSG2100PNC (32M) V5.X< V5.10.0
SiemensRUGGEDCOM RSG2288 V5.X< V5.10.0
SiemensRUGGEDCOM RSG2288NC V5.X< V5.10.0
SiemensRUGGEDCOM RSG2300 V5.X< V5.10.0
SiemensRUGGEDCOM RSG2300NC V5.X< V5.10.0
SiemensRUGGEDCOM RSG2300P V5.X< V5.10.0
SiemensRUGGEDCOM RSG2300PNC V5.X< V5.10.0
SiemensRUGGEDCOM RSG2488 V5.X< V5.10.0
SiemensRUGGEDCOM RSG2488NC V5.X< V5.10.0
SiemensRUGGEDCOM RSG907R< V5.10.0
SiemensRUGGEDCOM RSG908C< V5.10.0
SiemensRUGGEDCOM RSG909R< V5.10.0
SiemensRUGGEDCOM RSG910C< V5.10.0
SiemensRUGGEDCOM RSG920P V5.X< V5.10.0
SiemensRUGGEDCOM RSG920PNC V5.X< V5.10.0
SiemensRUGGEDCOM RSL910< V5.10.0
SiemensRUGGEDCOM RSL910NC< V5.10.0
SiemensRUGGEDCOM RST2228< V5.10.0
SiemensRUGGEDCOM RST2228P< V5.10.0
SiemensRUGGEDCOM RST916C< V5.10.0
SiemensRUGGEDCOM RST916P< V5.10.0

References

Timeline

Published
Jul 8, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-412258.8The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms aCVE-2025-412266.8VMware ESXi contains a denial-of-service vulnerability that occurs when performing a guest operation. A malicious actor with guest operationCVE-2025-412275.5VMware ESXi, Workstation, and Fusion contain a denial-of-service vulnerability due to certain guest options. A malicious actor with non-admiCVE-2025-412284.3VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor wiCVE-2025-412298.2VMware Cloud Foundation contains a directory traversal vulnerability. A malicious actor with network access to port 443 on VMware Cloud FounCVE-2025-41236.1A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attaCVE-2025-412307.5VMware Cloud Foundation contains an information disclosure vulnerability. A malicious actor with network access to port 443 on VMware Cloud CVE-2025-412317.3VMware Cloud Foundation contains a missing authorisation vulnerability. A malicious actor with access to VMware Cloud Foundation appliance mCVE-2025-412329.1Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. YoCVE-2025-412336.8Description: VMware AVI Load Balancer contains an authenticated blind SQL Injection vulnerability. VMware has evaluated the severity of theCVE-2025-412346.5Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file dowCVE-2025-412358.6Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.
CVE-2025-41224: High severity, CVSS 8.8 | Vulnix