Multiple Fortinet FortiOS Vulnerabilities (incl. CVE-2024-23113) Affect Siemens RUGGEDCOM APE1808 via Bundled Fortinet NGFW < V7.4.3 (SSA-832273)

Key facts for RUGGEDCOM APE1808 Fortinet flaws

Detection coverage for RUGGEDCOM APE1808 Fortinet flaws

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2489 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: FGFM (TCP/541) Unauthenticated Format-String RCE Attempt Against fgfmd — CVE-2024-23113

Detects network sessions and IDS alerts consistent with unauthenticated exploitation of the FortiGate-to-FortiManager (FGFM) management daemon's format-string vulnerability (CVE-2024-23113, CWE-134, CVSS 9.8, CISA KEV 2024-10-09) reachable on the bundled Fortinet NGFW inside Siemens RUGGEDCOM APE1808. Fires on inbound TCP/541 connections from outside the designated management network correlated with an IDS signature match for the fgfmd format-string exploit pattern.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1595, T1046
• Data sources: zeek_conn, suricata_ids, fortigate_event
• Severity: critical
• Confidence: high

Splunk SPL

index=network (sourcetype=corelight_conn OR sourcetype=suricata) dest_port=541
[| inputlookup fortigate_management_networks.csv | fields cidr | format]
NOT src_ip IN (mgmt_network_lookup)
| eval alert_signature=coalesce(alert_signature, "none")
| where match(alert_signature, "(?i)fgfm|fortios.*format.string|CVE-2024-23113") OR (sourcetype="corelight_conn" AND duration<2 AND orig_bytes>200)
| stats count min(_time) as first_seen max(_time) as last_seen values(alert_signature) as signatures by src_ip, dest_ip, dest_port
| where count>=1
| eval severity="critical", cve="CVE-2024-23113"
| table first_seen, last_seen, src_ip, dest_ip, dest_port, signatures, count, severity, cve

Microsoft KQL

let MgmtCIDRs = dynamic(["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"]);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceProduct in ("Suricata","Zeek","FortiGate")
| where DestinationPort == 541
| where not(ipv4_is_match(SourceIP, "10.0.0.0/8")) and not(ipv4_is_match(SourceIP, "172.16.0.0/12")) and not(ipv4_is_match(SourceIP, "192.168.0.0/16"))
| where DeviceCustomString1 has_any ("fgfm","format string","CVE-2024-23113") or isempty(DeviceCustomString1)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), ConnCount=count(), Signatures=make_set(DeviceCustomString1) by SourceIP, DestinationIP, DestinationPort
| where ConnCount >= 1
| extend Severity="critical", CVE="CVE-2024-23113"
| project FirstSeen, LastSeen, SourceIP, DestinationIP, DestinationPort, Signatures, ConnCount, Severity, CVE

Sigma

title: FGFM (TCP/541) Unauthenticated Connection from Untrusted Network — Possible CVE-2024-23113 Exploitation
id: 7f3c1a2e-9d4b-4e11-8a2f-1c9e5b7d3a01
status: experimental
description: Detects inbound connections to the FortiGate-to-FortiManager (FGFM) management port (TCP/541) originating from outside the designated management network, correlated with IDS signatures for the fgfmd format-string RCE (CVE-2024-23113).
references:
    - https://www.fortiguard.com/psirt/FG-IR-24-029
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23113
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-13
tags:
    - attack.initial-access
    - attack.t1190
    - attack.reconnaissance
    - attack.t1595
    - cve.2024.23113
logsource:
    category: network_connection
    product: zeek
detection:
    selection:
        dst_port: 541
    filter_mgmt:
        src_ip|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection and not filter_mgmt
falsepositives:
    - Legitimate FortiManager-to-FortiGate management traffic from an unlisted management CIDR not yet added to the allowlist
level: critical

Known false positives:

• Legitimate FortiManager-to-FortiGate management traffic from a management CIDR not yet added to the allowlist

Tuning notes: Maintain and periodically audit fortigate_management_networks.csv so legitimate FortiManager CIDRs are excluded; tighten the orig_bytes/duration heuristic once local IDS signature coverage for CVE-2024-23113 is confirmed active.

• 🔒 curl SOCKS5 Proxy Heap Buffer Overflow via Oversized Hostname — CVE-2023-38545 · unlock with TL Creds
• 🔒 FortiGate HA Cluster Improper Privilege Management Exploitation — CVE-2023-44250 · unlock with TL Creds
• 🔒 SSL-VPN Bookmark Cross-User IDOR Enumeration — CVE-2024-23112 · unlock with TL Creds
• 🔒 Vulnerability Scanning & Network Service Discovery Against RUGGEDCOM APE1808 Bundled NGFW Management Ports · unlock with TL Creds
• 🔒 FortiAuthenticator-HA Read-Only to Read-Write Escalation via Repeated Login Attempts — CVE-2023-46717 · unlock with TL Creds
• 🔒 Missing-Authentication Exploitation of Remote FortiOS Management Service & Host-Header Cache Poisoning — CVE-2024-26011 / CVE-2022-23439 · unlock with TL Creds
• 🔒 FortiOS CLI Format-String Arbitrary Code Execution Cluster — CVE-2023-48784/36640/40721/45583 · unlock with TL Creds
• 🔒 HTTP/2 Rapid Reset Resource-Exhaustion Flood Against FGFM/SSL-VPN Listener — CVE-2023-44487 · unlock with TL Creds

Indicators of compromise for RUGGEDCOM APE1808 Fortinet flaws

As of 2026-11-07, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-2489.

How RUGGEDCOM APE1808 Fortinet flaws works

SSA-832273 is a Siemens ProductCERT advisory tracking third-party component risk: RUGGEDCOM APE1808 is a Siemens ruggedized application-processing-engine module deployed inside substation, rail, and utility RTU/gateway hardware, and it ships a bundled Fortinet NGFW (FortiOS-based) image below V7.4.3 that inherits 28 upstream Fortinet/curl CVEs. Because the NGFW is an embedded, bundled component rather than a standalone appliance the customer directly patches, the exposure persists on OT devices until Siemens ships (or the operator applies) an updated bundle image, independent of Fortinet's own patch cadence.

The most severe issue, CVE-2024-23113 (CVSS 9.8, CWE-134), is a use of externally-controlled format string in the fgfmd daemon that implements the FortiGate-to-FortiManager (FGFM) management protocol: a remote, unauthenticated attacker reaching the exposed FGFM service can send a crafted packet whose payload is passed unsanitized into a printf-style formatting function, yielding arbitrary code execution. Fortinet disclosed it via FG-IR-24-029; CISA added it to the KEV catalog on 2024-10-09 confirming active exploitation and mandating a three-week remediation window for federal agencies. As of 2024-10-15, Shadowserver reported 87,000+ internet-facing Fortinet devices were still vulnerable.

A second independently critical component is CVE-2023-38545 (CVSS 9.8, CWE-787), a heap buffer overflow in curl's SOCKS5 proxy handshake: when a target hostname exceeds 255 bytes during a slow handshake, an internal name-resolution-mode variable can be mis-set, causing curl to copy the oversized hostname into a fixed-size heap buffer meant for a resolved address. Because FortiOS bundles curl/libcurl, this upstream flaw (patched in curl 8.4.0) is inherited transitively; curl's own advisory lists SSA-832273 among the affected downstream products.

The bundle further includes CVE-2023-44487 (HTTP/2 Rapid Reset, CVSS 7.5), which enabled record-scale DDoS floods against HTTP/2 services worldwide in August-October 2023 by rapidly opening and RST-cancelling streams to exhaust server-side request-processing resources; a cluster of FortiOS/FortiProxy/FortiPAM/FortiSwitchManager CLI format-string bugs (CVE-2023-48784, CVE-2023-36640, CVE-2023-40721, CVE-2023-45583) that let a privileged CLI operator escalate to arbitrary code execution; an SSL-VPN bookmark IDOR (CVE-2024-23112, FG-IR-24-013, CWE-639) letting an authenticated user view another user's stored SSL-VPN bookmarks; an HA-cluster privilege-management flaw (CVE-2023-44250, FG-IR-23-315, CVSS 8.3) and a FortiAuthenticator-HA authentication flaw (CVE-2023-46717, CVSS 8.8) that let a read-only operator escalate to read-write; a missing-authentication flaw affecting the wider Fortinet product family (CVE-2024-26011, FG-IR-24-032, CVSS 9.8); a double-free in JSON object handling (CVE-2023-44247, FG-IR-23-195, CWE-415) reachable via crafted HTTP/HTTPS requests; and a web-cache-poisoning flaw via attacker-controlled Host headers (CVE-2022-23439, CWE-610) across the Fortinet product line.

Siemens states the source advisory reports no confirmed active exploitation specifically against RUGGEDCOM APE1808 deployments; severity here is driven by the CVSS 9.8 ceiling and OT-device exposure, though CVE-2024-23113 is independently confirmed under active exploitation in the wild against Fortinet deployments generally per the CISA KEV listing. Siemens' primary remediation is upgrading the bundled Fortinet NGFW to V7.4.3 or later, or contacting Siemens customer support for patch guidance; per-CVE Fortinet workarounds (disabling FGFM interface access, disabling SSL-VPN web mode, disabling FortiAuthenticator push notifications, setting admin-host to prevent Host-header abuse) apply where the underlying FortiOS build cannot be immediately updated.

MITRE ATT&CK techniques by tactic:

Discovery

T1046 Network Service Discovery

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1499 Endpoint Denial of Service

Credential Access

T1552 Unsecured Credentials

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning

Remediation for RUGGEDCOM APE1808 Fortinet flaws

Patches

• Update the RUGGEDCOM APE1808's bundled Fortinet NGFW to V7.4.3 or later per Siemens SSA-832273
• Apply Fortinet FG-IR-24-029 fixed builds for CVE-2024-23113 (FortiOS 7.0.14+, 7.2.7+, 7.4.3+; FortiProxy 7.0.15+, 7.2.9+, 7.4.3+; FortiPAM 1.0.4+/1.1.3+/1.2.1+; FortiSwitchManager 7.0.4+/7.2.4+)
• Apply the curl 8.4.0+ fix for CVE-2023-38545 where curl/libcurl is bundled independently of the FortiOS release train
• Apply Fortinet FG-IR-23-315 fixed builds (FortiOS 7.2.6+/7.4.2+) for CVE-2023-44250
• Apply Fortinet FG-IR-24-013 fixed builds for CVE-2024-23112 and FG-IR-24-032 fixed builds for CVE-2024-26011

Immediate actions

• Restrict or disable exposure of the FGFM management service (default TCP/541) on every interface to close CVE-2024-23113's unauthenticated attack surface
• Disable SSL-VPN web mode where CVE-2024-23112 (bookmark IDOR) and related SSL-VPN issues cannot yet be patched
• Disable FortiAuthenticator push notifications as an interim mitigation for CVE-2023-46717
• Set the admin-host property to the device hostname to prevent Host-header-based cache poisoning (CVE-2022-23439)
• Restrict CLI/administrative access to trusted management networks only, since multiple format-string CVEs (CVE-2023-48784, CVE-2023-36640, CVE-2023-40721, CVE-2023-45583) require privileged CLI or HTTP(S) access to trigger

Workarounds

• Disable FGFM access per interface (CVE-2024-23113 interim mitigation per Fortinet advisory)
• Disable SSL-VPN web mode (CVE-2024-23112 interim mitigation)
• Set admin-host to the device hostname to disable Host-header redirection (CVE-2022-23439 interim mitigation)
• Contact Siemens customer support for interim patch guidance specific to the RUGGEDCOM APE1808 bundle

Longer-term hardening

• Track Siemens ProductCERT revisions to SSA-832273 for the RUGGEDCOM APE1808 bundle image update carrying Fortinet NGFW V7.4.3+
• Establish a patch-tracking process for embedded/bundled third-party firmware inside OT gateway hardware, since bundled components lag the upstream vendor's own patch cadence
• Deploy network segmentation between RUGGEDCOM APE1808 management interfaces and untrusted networks to reduce exposure to unauthenticated exploitation paths
• Monitor CISA KEV and Shadowserver internet-exposure reporting for CVE-2024-23113 given confirmed active exploitation against Fortinet deployments generally

Affected and fixed versions

• Siemens — RUGGEDCOM APE1808
  Vulnerable versions: All versions with bundled Fortinet NGFW earlier than V7.4.3
  Fixed in: Bundled Fortinet NGFW V7.4.3 or later
• Fortinet — FortiOS
  Vulnerable versions: 7.0.0-7.0.13; 7.2.0-7.2.6; 7.4.0-7.4.2; 6.4.x and 6.2.x for select CLI format-string CVEs
  Fixed in: 7.0.14+; 7.2.7+; 7.4.3+ (per-CVE fixed builds vary; see individual FG-IR advisories)
• Fortinet — FortiProxy
  Vulnerable versions: 7.0.0-7.0.14; 7.2.0-7.2.8; 7.4.0-7.4.2
  Fixed in: 7.0.15+; 7.2.9+; 7.4.3+
• Fortinet — FortiPAM
  Vulnerable versions: 1.0.0-1.0.3; 1.1.0-1.1.2; 1.2.0
  Fixed in: 1.0.4+; 1.1.3+; 1.2.1+
• Fortinet — FortiSwitchManager
  Vulnerable versions: 7.0.0-7.0.3; 7.2.0-7.2.3
  Fixed in: 7.0.4+; 7.2.4+

Timeline of RUGGEDCOM APE1808 Fortinet flaws

Last updated 2026-11-07 · revalidated 1× · latest source

• 2023-10-10 CVE-2023-44487 (HTTP/2 Rapid Reset) is publicly disclosed via coordinated vendor advisories after being exploited in the wild for record-scale DDoS since August 2023.
• 2023-10-11 The curl project ships version 8.4.0, fixing the CVE-2023-38545 SOCKS5 proxy heap buffer overflow later inherited into this FortiOS advisory bundle.
• 2023-12-12 locked-ioc-9 publishes FG-IR-23-315 (CVE-2023-44250, HA cluster privilege escalation) and FG-IR-23-195 (CVE-2023-44247, double free in json_object_put).
• 2024-02-08 locked-ioc-9 publishes FG-IR-24-029 disclosing CVE-2024-23113, a critical unauthenticated format-string RCE in the locked-ioc-11 daemon (CVSS 9.8), alongside FG-IR-24-013 (CVE-2024-23112) and FG-IR-24-032 (CVE-2024-26011).
• 2024-02-15 CVE-2024-23113 is published in NVD with CVSS 3.1 score 9.8 (CWE-134).
• 2024-03-12 locked-ioc-8 issues the initial SSA-832273 V1.0 advisory listing Fortinet FortiOS vulnerabilities affecting RUGGEDCOM APE1808 devices running bundled Fortinet NGFW below V7.4.3.
• 2024-04-09 Siemens SSA-832273 V1.1 adds 4 CVEs and updates remediations; Fortinet publishes FG-IR-23-224 (CVE-2024-23662).
• 2024-05-14 Siemens SSA-832273 V1.2 adds 3 CVEs.
• 2024-10-09 CISA adds CVE-2024-23113 to the Known Exploited Vulnerabilities catalog, confirming active exploitation and giving U.S. federal agencies a three-week remediation deadline.
• 2024-10-11 Fortinet records wild exploitation of CVE-2024-23113 as detected.
• 2024-10-15 The Shadowserver Foundation reports over 87,000 internet-facing Fortinet devices remain vulnerable to CVE-2024-23113 months after the patch became available.
• 2024-10-17 Fortinet updates FG-IR-24-029 noting active exploitation.
• 2026-01-13 Siemens updates SSA-832273 to revision V2.1, the current version tracked by this threat record, reflecting the accumulated bundle of 28 Fortinet CVEs.

Update history

• 2026-11-07 — Multiple Vulnerabilities in Fortigate NGFW Before V7.4.3 on locked-ioc-6 Devices (SSA-832273) incl. CVE-2024-23113: What changed No field escalation: severity CRITICAL, exploitability ACTIVE, status ACTIVE and CVSS 9.8 already match the newer report. The update is additive coverage: two captive-portal CVEs, two CWEs, advisory revision history and exploit

Sources cited for RUGGEDCOM APE1808 Fortinet flaws

• Siemens Security Advisory SSA-832273 (V2.1): Multiple Vulnerabilities in Fortinet NGFW Before V7.4.3 on RUGGEDCOM APE1808 Devices cert-portal.siemens.com · Advisory · 2026-01-13
• CISA Known Exploited Vulnerabilities Catalog - CVE-2024-23113 CISA · Government advisory · 2024-10-09
• FG-IR-24-029: FortiOS - Format string bug in fgfmd FortiGuard Labs · Vendor report · 2024-02-08
• CVE-2023-38545 - curl SOCKS5 heap buffer overflow curl.se · Vendor report · 2023-10-11
• FG-IR-24-013: Authorization bypass in SSLVPN bookmarks FortiGuard Labs · Vendor report · 2024-02-08
• FG-IR-23-315: FortiOS - Privilege escalation in FortiGate HA cluster FortiGuard Labs · Vendor report · 2023-12-12
• NVD Detail - CVE-2024-23113 NVD (NIST) · Research · 2024-02-08
• FG-IR-24-032: Missing authentication for FGFM access control FortiGuard Labs · Vendor report · 2024-02-08
• CVE-2023-44247 - Double free with double usage of json_object_put (FG-IR-23-195) GitHub · Code repository · 2023-12-12
• Technical Breakdown: HTTP/2 Rapid Reset DDoS Attack blog.cloudflare.com · Blog · 2023-10-10
• 87,000+ Fortinet devices still open to attack, are yours among them? (CVE-2024-23113) Help Net Security · News · 2024-10-15
• Organizations Warned of Exploited Fortinet FortiOS Vulnerability SecurityWeek · News · 2024-10-09

More in vulnerability

• Siemens SSA-698820: Multiple Fortigate NGFW Vulnerabilities (before V7.4.4) on RUGGEDCOM APE1808 Devices
• Siemens SSA-827968: Multiple Vulnerabilities in Nozomi Guardian/CMC < V26.2.0 on RUGGEDCOM APE1808 (17 CVEs)
• Local Privilege Escalation in Siemens TeleControl Server Basic before V3.1.2.4 (CVE-2025-40942)
• Privilege Escalation in WIBU CodeMeter Runtime Affecting Siemens Desigo CC Product Family and SENTRON Powermanager (CVE-2025-47809)
• Siemens SSA-282044: DLL Hijacking in Siemens Web Installer (SIWA) used by Online Software Delivery (CVE-2025-30033)

Previous and next in vulnerability

• Multiple Vulnerabilities in Nozomi Guardian/CMC Before 25.4.0 on Siemens RUGGEDCOM APE1808 Devices (CVE-2024-13089, CVE-2024-13090, CVE-2025-3719, CVE-2025-40889, et al.) Previous report
• CISA Adds Actively Exploited Cisco Secure Email Gateway SQL Injection (CVE-2026-76461) to KEV Catalog Next report