Medium severity · published Dec 9, 2025
CVE-2025-40935
A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.10.1), RUGGEDCOM RS416Pv2 V5.X (All versions < V5.10.1), RUGGEDCOM RS416v2 V5.X (All versions <…
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.10.1), RUGGEDCOM RS416Pv2 V5.X (All versions < V5.10.1), RUGGEDCOM RS416v2 V5.X (All versions < V5.10.1), RUGGEDCOM RS900 (32M) V5.X (All versions < V5.10.1), RUGGEDCOM RS900G (32M) V5.X (All versions < V5.10.1), RUGGEDCOM RSG2100 (32M) V5.X (All versions < V5.10.1), RUGGEDCOM RSG2100P (32M) V5.X (All versions < V5.10.1), RUGGEDCOM RSG2288 V5.X (All versions < V5.10.1), RUGGEDCOM RSG2300 V5.X (All versions < V5.10.1), RUGGEDCOM RSG2300P V5.X (All versions < V5.10.1), RUGGEDCOM RSG2488 V5.X (All versions < V5.10.1), RUGGEDCOM RSG907R (All versions < V5.10.1), RUGGEDCOM RSG908C (All versions < V5.10.1), RUGGEDCOM RSG909R (All versions < V5.10.1), RUGGEDCOM RSG910C (All versions < V5.10.1), RUGGEDCOM RSG920P V5.X (All versions < V5.10.1), RUGGEDCOM RSL910 (All versions < V5.10.1), RUGGEDCOM RST2228 (All versions < V5.10.1), RUGGEDCOM RST2228P (All versions < V5.10.1), RUGGEDCOM RST916C (All versions < V5.10.1), RUGGEDCOM RST916P (All versions < V5.10.1). Affected devices do not properly validate input during the TLS certificate upload process of the web service. This could allow an authenticated remote attacker to trigger a device crash and reboot, leading to a temporary Denial of Service on the device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RR
RUGGEDCOM RMC8388 V5.X · Siemens
before V5.10.1 · source: vendor
RR
RUGGEDCOM RS416Pv2 V5.X · Siemens
before V5.10.1 · source: vendor
RR
RUGGEDCOM RS416v2 V5.X · Siemens
before V5.10.1 · source: vendor
RR
RUGGEDCOM RS900 (32M) V5.X · Siemens
before V5.10.1 · source: vendor
RR
RUGGEDCOM RS900G (32M) V5.X · Siemens
before V5.10.1 · source: vendor
RR
RUGGEDCOM RSG2100 (32M) V5.X · Siemens
before V5.10.1 · source: vendor
RR
RUGGEDCOM RSG2100P (32M) V5.X · Siemens
before V5.10.1 · source: vendor
RR
RUGGEDCOM RSG2288 V5.X · Siemens
before V5.10.1 · source: vendor
RR
RUGGEDCOM RSG2300 V5.X · Siemens
before V5.10.1 · source: vendor
RR
RUGGEDCOM RSG2300P V5.X · Siemens
before V5.10.1 · source: vendor
RR
RUGGEDCOM RSG2488 V5.X · Siemens
before V5.10.1 · source: vendor
RR
RUGGEDCOM RSG907R · Siemens
before V5.10.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-40935
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-40935
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-763474.html
More from RUGGEDCOM RMC8388 V5.X
9.8
CVE-2023-24845
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC,…
8.8
CVE-2025-41224
A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.10.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.10.0), RUGGEDCOM RS416NCv2 V5.X (All versions <…
8.0
CVE-2022-34663
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC,…
7.5
CVE-2023-52237
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC,…
7.5
CVE-2023-39269
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC,…