CVE-2025-41223

CVE-2025-41223 is a vulnerability affecting numerous RUGGEDCOM i800, M2100, M2200, M969, RMC30, RMC8388, RP110, RS1600, RS400, RS416, RS8000, RS900, RS900G, RS900GP, RS900L, RS900M, RS900W, RS910, RS920L, RS920W, RS930L, RS930W, RS940G, RS969, RSG2100, RSG2200, RSG2288, RSG2300, RSG2488, RSG907R, RSG908C, RSG909R, RSG910C, RSG920P, RSL910, RST2228, RST2228P, RST916C, and RST916P devices across various versions. The vulnerability stems from the use of the TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 cipher suite, which employs the Cipher Block Chaining (CBC) mode susceptible to timing attacks. Rated with a CVSS score of 4.8 (Medium), this vulnerability has a network attack vector and high attack complexity, requiring no user interaction or privileges. A successful exploit could lead to a limited compromise of both confidentiality and integrity of encrypted communications. There is currently no evidence of active exploitation, publicly available exploit code (e.g., Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.