Three chained zero‑days let attackers own Siemens ROX II OT switches
Unit 42 and Siemens identified a chain of three zero‑day flaws (CVE‑2025‑40948/40947/40949) in ROX II OT switches that let an attacker read any file, inject commands as root, and install a persistent cron back‑door. Exploitation gives full control over critical industrial networks, prompting Siemens to push an emergency firmware update (V2.17.1).