CVE-2025-41223: RUGGEDCOM Information Disclosure Flaw

CVE-2025-41223 Overview

CVE-2025-41223 affects a broad range of Siemens RUGGEDCOM ROS-based industrial network devices. The affected devices support the TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 cipher suite. This cipher uses Cipher Block Chaining (CBC) mode, which is susceptible to timing side-channel attacks. An attacker positioned on the network can leverage timing differences during CBC decryption to compromise the integrity and confidentiality of encrypted communications. The vulnerability is categorized under [CWE-327: Use of a Broken or Risky Cryptographic Algorithm].

Critical Impact
A network-based attacker can decrypt or manipulate TLS traffic protected by the weak CBC cipher suite, undermining the confidentiality and integrity of management sessions on industrial ROS devices.

Affected Products

RUGGEDCOM RMC8388 V5.X, RS416Pv2 V5.X, RS416v2 V5.X (all versions prior to V5.10.0)
RUGGEDCOM RSG2100/RSG2100P/RSG2288/RSG2300/RSG2300P/RSG2488 V5.X, RSG920P V5.X (all versions prior to V5.10.0)
RUGGEDCOM RSG907R, RSG908C, RSG909R, RSG910C, RSL910, RST2228, RST2228P, RST916C, RST916P (all versions prior to V5.10.0), plus all versions of legacy RUGGEDCOM i800/i801/i802/i803, M2100/M2200/M969, RMC30, RP110, RS1600/RS400 series, RS8000 series, RS900 series, RS910/920/930/940/969 series, RSG2100/2200 (V4.X)

Discovery Timeline

2025-07-08 - CVE-2025-41223 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-41223

Vulnerability Analysis

The vulnerability resides in the TLS stack of RUGGEDCOM ROS firmware. Affected devices advertise and negotiate TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, a cipher suite that combines AES-128 in CBC mode with HMAC-SHA256 authentication in a MAC-then-encrypt construction. This construction has been publicly known to be vulnerable to timing-based padding oracle attacks since the disclosure of Lucky13 and its variants.

Because RUGGEDCOM devices are used as ethernet switches and serial servers in substation, rail, and process control environments, TLS is typically used to protect management access to the web interface and configuration APIs. Successful exploitation exposes administrative credentials, configuration data, and session tokens exchanged between operators and the device.

Root Cause

The root cause is the continued support for a cryptographically weak cipher suite. CBC-mode TLS ciphers require constant-time MAC verification and padding checks to resist timing analysis. Even carefully implemented CBC stacks routinely leak measurable timing information under network conditions, which is why modern deployments deprecate CBC in favor of AEAD ciphers such as AES-GCM or ChaCha20-Poly1305.

Attack Vector

Exploitation requires network access to the TLS endpoint on the device and the ability to observe or influence a large number of encrypted sessions. The attacker collects timing measurements of server responses to malformed CBC ciphertexts and statistically recovers plaintext bytes. High attack complexity reflects the need for repeated probing and precise timing measurements. No authentication or user interaction is required.

No verified public proof-of-concept code exists for this specific advisory. The general exploitation technique is documented in academic literature on Lucky13 and related padding oracle attacks against CBC-mode TLS. See the Siemens Security Advisory SSA-083019 for vendor technical details.

Detection Methods for CVE-2025-41223

Indicators of Compromise

Unusually high volume of TLS handshakes to RUGGEDCOM management interfaces (ports 443/https or configured management ports) from a single source over a short window.
TLS sessions negotiating TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 from clients other than known administrator workstations.
Repeated TLS bad_record_mac or decryption_failed alerts logged by the device.

Detection Strategies

Scan the OT network for RUGGEDCOM devices advertising CBC cipher suites using tools such as nmap --script ssl-enum-ciphers or testssl.sh.
Correlate management-plane authentication events with unusual TLS session termination patterns to spot active timing probes.
Alert on ROS firmware versions below V5.10.0 reported by asset inventory or configuration management.

Monitoring Recommendations

Continuously monitor TLS negotiations at the boundary between IT and OT networks and flag negotiations of deprecated CBC ciphers.
Log and review all administrative sessions to RUGGEDCOM devices, including source IP, cipher suite, and session duration.
Track firmware versions across the RUGGEDCOM fleet and generate alerts when devices remain on vulnerable releases.

How to Mitigate CVE-2025-41223

Immediate Actions Required

Upgrade affected RUGGEDCOM ROS V5.X devices to firmware V5.10.0 or later, as directed by Siemens.
Restrict management-plane network access to a dedicated administration VLAN with strict access control lists.
Rotate any credentials, certificates, or shared secrets that may have been exposed over TLS sessions on affected devices.

Patch Information

Siemens published advisory SSA-083019 covering CVE-2025-41223. Fixed firmware is available for ROS V5.X product lines at version V5.10.0 and later. Legacy V4.X models and end-of-life RUGGEDCOM products listed as "All versions" do not have a fix and require compensating controls.

Workarounds

Disable the TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 cipher suite in the device TLS configuration where the option is exposed, and prefer AEAD ciphers.
Place unpatchable legacy RUGGEDCOM devices behind a hardened jump host or industrial firewall that terminates TLS with a modern cipher suite.
Limit management access to trusted operator workstations using firewall rules and disable unused network services on the device.

bash

# Example: enumerate supported TLS ciphers on a RUGGEDCOM management interface
nmap --script ssl-enum-ciphers -p 443 <ruggedcom-device-ip>

# Example: verify whether the weak CBC cipher is still offered
testssl.sh --cipher-per-proto https://<ruggedcom-device-ip>