# Multiple Fortinet FortiOS Vulnerabilities (incl. CVE-2024-23113) Affect Siemens RUGGEDCOM APE1808 via Bundled Fortinet NGFW < V7.4.3 (SSA-832273)

> Siemens ProductCERT advisory SSA-832273 (rev V2.1, 2026-01-13) lists 28 Fortinet FortiOS/FortiProxy/FortiPAM/FortiSwitchManager CVEs affecting RUGGEDCOM APE1808 OT devices that bundle Fortinet NGFW below V7.4.3. The most severe, CVE-2024-23113, is an unauthenticated remote format-string RCE in the fgfmd daemon (CVSS 9.8) that CISA added to its Known Exploited Vulnerabilities catalog on 2024-10-09; the bundle also includes the curl SOCKS5 heap overflow (CVE-2023-38545) and the HTTP/2 Rapid Reset DoS (CVE-2023-44487).

- **Published:** 2026-09-13T00:00:00Z
- **Last reviewed:** 2026-09-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2489
- **ID:** TL-2026-2489
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 5 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-38545, CVE-2023-38546, CVE-2023-44250, CVE-2023-44487, CVE-2024-23113, CVE-2023-47537, CVE-2023-46717, CVE-2024-23112, CVE-2023-41677, CVE-2024-23662, CVE-2023-48784, CVE-2023-45586, CVE-2024-26007, CVE-2023-36640, CVE-2023-45583, CVE-2023-44247, CVE-2023-46714, CVE-2024-23110, CVE-2022-45862, CVE-2024-26011, CVE-2022-23439, CVE-2023-42785, CVE-2023-42786, CVE-2023-46715, CVE-2023-40721, CVE-2025-54822, CVE-2023-46718, CVE-2024-40593

## Description

SSA-832273 is a Siemens ProductCERT advisory tracking third-party component risk: RUGGEDCOM APE1808 is a Siemens ruggedized application-processing-engine module deployed inside substation, rail, and utility RTU/gateway hardware, and it ships a bundled Fortinet NGFW (FortiOS-based) image below V7.4.3 that inherits 28 upstream Fortinet/curl CVEs. Because the NGFW is an embedded, bundled component rather than a standalone appliance the customer directly patches, the exposure persists on OT devices until Siemens ships (or the operator applies) an updated bundle image, independent of Fortinet's own patch cadence.

The most severe issue, CVE-2024-23113 (CVSS 9.8, CWE-134), is a use of externally-controlled format string in the fgfmd daemon that implements the FortiGate-to-FortiManager (FGFM) management protocol: a remote, unauthenticated attacker reaching the exposed FGFM service can send a crafted packet whose payload is passed unsanitized into a printf-style formatting function, yielding arbitrary code execution. Fortinet disclosed it via FG-IR-24-029; CISA added it to the KEV catalog on 2024-10-09 confirming active exploitation and mandating a three-week remediation window for federal agencies. As of 2024-10-15, Shadowserver reported 87,000+ internet-facing Fortinet devices were still vulnerable.

A second independently critical component is CVE-2023-38545 (CVSS 9.8, CWE-787), a heap buffer overflow in curl's SOCKS5 proxy handshake: when a target hostname exceeds 255 bytes during a slow handshake, an internal name-resolution-mode variable can be mis-set, causing curl to copy the oversized hostname into a fixed-size heap buffer meant for a resolved address. Because FortiOS bundles curl/libcurl, this upstream flaw (patched in curl 8.4.0) is inherited transitively; curl's own advisory lists SSA-832273 among the affected downstream products.

The bundle further includes CVE-2023-44487 (HTTP/2 Rapid Reset, CVSS 7.5), which enabled record-scale DDoS floods against HTTP/2 services worldwide in August-October 2023 by rapidly opening and RST-cancelling streams to exhaust server-side request-processing resources; a cluster of FortiOS/FortiProxy/FortiPAM/FortiSwitchManager CLI format-string bugs (CVE-2023-48784, CVE-2023-36640, CVE-2023-40721, CVE-2023-45583) that let a privileged CLI operator escalate to arbitrary code execution; an SSL-VPN bookmark IDOR (CVE-2024-23112, FG-IR-24-013, CWE-639) letting an authenticated user view another user's stored SSL-VPN bookmarks; an HA-cluster privilege-management flaw (CVE-2023-44250, FG-IR-23-315, CVSS 8.3) and a FortiAuthenticator-HA authentication flaw (CVE-2023-46717, CVSS 8.8) that let a read-only operator escalate to read-write; a missing-authentication flaw affecting the wider Fortinet product family (CVE-2024-26011, FG-IR-24-032, CVSS 9.8); a double-free in JSON object handling (CVE-2023-44247, FG-IR-23-195, CWE-415) reachable via crafted HTTP/HTTPS requests; and a web-cache-poisoning flaw via attacker-controlled Host headers (CVE-2022-23439, CWE-610) across the Fortinet product line.

Siemens states the source advisory reports no confirmed active exploitation specifically against RUGGEDCOM APE1808 deployments; severity here is driven by the CVSS 9.8 ceiling and OT-device exposure, though CVE-2024-23113 is independently confirmed under active exploitation in the wild against Fortinet deployments generally per the CISA KEV listing. Siemens' primary remediation is upgrading the bundled Fortinet NGFW to V7.4.3 or later, or contacting Siemens customer support for patch guidance; per-CVE Fortinet workarounds (disabling FGFM interface access, disabling SSL-VPN web mode, disabling FortiAuthenticator push notifications, setting admin-host to prevent Host-header abuse) apply where the underlying FortiOS build cannot be immediately updated.

## MITRE ATT&CK

- T1595 Active Scanning
- T1046 Network Service Discovery
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1552 Unsecured Credentials

## Sources

- [Siemens Security Advisory SSA-832273 (V2.1): Multiple Vulnerabilities in Fortinet NGFW Before V7.4.3 on RUGGEDCOM APE1808 Devices](https://cert-portal.siemens.com/productcert/html/ssa-832273.html)
- [FG-IR-24-029: FortiOS - Format string bug in fgfmd](https://www.fortiguard.com/psirt/FG-IR-24-029)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2024-23113](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23113)
- [CVE-2023-38545 - curl SOCKS5 heap buffer overflow](https://curl.se/docs/CVE-2023-38545.html)
- [Technical Breakdown: HTTP/2 Rapid Reset DDoS Attack](https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/)
- [87,000+ Fortinet devices still open to attack, are yours among them? (CVE-2024-23113)](https://www.helpnetsecurity.com/2024/10/15/cve-2024-23113/)
- [FG-IR-24-013: Authorization bypass in SSLVPN bookmarks](https://www.fortiguard.com/psirt/FG-IR-24-013)
- [FG-IR-23-315: FortiOS - Privilege escalation in FortiGate HA cluster](https://www.fortiguard.com/psirt/FG-IR-23-315)
- [CVE-2023-44247 - Double free with double usage of json_object_put (FG-IR-23-195)](https://github.com/advisories/GHSA-f7hp-qcv4-6w2q)
- [NVD Detail - CVE-2024-23113](https://nvd.nist.gov/vuln/detail/CVE-2024-23113)
- [Organizations Warned of Exploited Fortinet FortiOS Vulnerability](https://www.securityweek.com/organizations-warned-of-exploited-fortinet-fortios-vulnerability/)
- [FG-IR-24-032: Missing authentication for FGFM access control](https://www.fortiguard.com/psirt/FG-IR-24-032)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2489