CVE-2024-56836CWE-77command-injection

CVE-2024-56836

High · published December 9, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
36.6
In the wild
Unconfirmed
What it is

🚨 A single misconfiguration during Dynamic DNS setup could give attackers root access to your RUGGEDCOM devices! 🔥 Think of this vulnerability like an unsuspecting hotel guest who accidentally leaves a window unlocked during a storm. Just as a thief could slip in through that window, an attacker can exploit this vulnerability to gain unauthorized access and wreak havoc! With root access, an attacker could manipulate any system aspect, steal sensitive data, change configurations, or even bring the entire service crashing down. The implications are absolutely devastating, especially in critical infrastructure environments where these devices are often used!

Put simply

Think of this vulnerability like an unsuspecting hotel guest who accidentally leaves a window unlocked during a storm. Just as a thief could slip in through that window, an attacker can exploit this vulnerability to gain unauthorized access and wreak havoc! This high-risk vulnerability allows injection of additional configuration parameters during Dynamic DNS setup on RUGGEDCOM devices, enabling attackers to spawn a reverse shell and gain root access. Affected versions include all versions below V2.17.0 across multiple RUGGEDCOM products.

What to do

With root access, an attacker could manipulate any system aspect, steal sensitive data, change configurations, or even bring the entire service crashing down. The implications are absolutely devastating, especially in critical infrastructure environments where these devices are often used! To mitigate this risk, immediately upgrade all affected RUGGEDCOM devices to version 2.17.0 or later. Additionally, review your DNS configuration settings to ensure they are correctly implemented and secure. Regular audits can help catch any misconfigurations before they are exploited. You’ve got this! By following these steps, you can safeguard your network and maintain your status as a security hero! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00433 · 36.6th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2025-12-09T21:17Z
Affected products (1)
ProductVersionsFixed in
siemens/ruggedcom_rox_ii_firmware< 2.17.02.17.0
References (1)
EPSS history
Timeline
  • 09 DEC 10:44Z
    A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400…
    cvelistv5