Siemens RUGGEDCOM APE1808: 2 CVEs, Medium 6.1
Summary
CISA reports 2 vulnerabilities in Siemens RUGGEDCOM APE1808. Weakness types: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens recommends to contact customer support for additional information, and follow Fortinet advisory for workarounds and mitigation measures. Highest CVSS v3 score: 6.1 (Medium), exploitable over the network.
At a glance
- Vendor
- Siemens
- Products
- RUGGEDCOM APE1808
- CVEs
- CVE-2026-23573, CVE-2026-59839
- Highest CVSS v3
- 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Energy, Transportation Systems
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-23573 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 6.1 | – | No | CVE-2026-23573 |
| CVE-2026-59839 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 5.5 | – | No | CVE-2026-59839 |
Affected products (1)
- RUGGEDCOM APE1808 with Fortinet NGFW
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Contact customer support to receive detailed information
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-225-06
- Machine-readable CSAF record
- https://cert-portal.siemens.com/productcert/csaf/ssa-127084.json
- https://cert-portal.siemens.com/productcert/html/ssa-127084.html
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.