Threat reportVulnerabilityTL-2026-5305
Multiple Vulnerabilities in Fortigate NGFW Before V7.4.1 on Siemens RUGGEDCOM APE1808 Devices (SSA-366067)
Siemens ProductCERT advisory SSA-366067 reports dozens of Fortinet FortiOS/NGFW CVEs affecting RUGGEDCOM APE1808 devices running Fortinet NGFW before V7.4.1, including unauthenticated remote code execution (CVE-2023-25610, CVE-2023-33308) and an FGFM authentication bypass (CVE-2024-26009). Siemens' remediation is to update the Fortigate NGFW to V7.4.1.
Key facts for TL-2026-5305
Detection coverage for TL-2026-5305
As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5305 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: FGFM (TCP/541) Connection From Non-FortiManager Host (CVE-2024-26009) — Lateral Movement
Detects FGFM (FortiGate-FortiManager protocol, TCP 541) sessions from hosts that are not the approved FortiManager. CVE-2024-26009 is an FGFM authentication bypass (CVSS 8.1) where an unauthenticated attacker who knows the managing FortiManager serial number can send crafted FGFM requests and take control of a managed device. Fortinet offers no workaround, so network-level detection and restriction matter.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1190, T1210, T1133
- Data sources: fortigate_traffic, CommonSecurityLog
- Severity: high
- Confidence: medium
Splunk SPL
index=fortinet sourcetype="fortigate_traffic" earliest=-24h dstport=541 NOT srcip IN ("198.51.100.10") | stats count sum(sentbyte) AS bytes_sent sum(rcvdbyte) AS bytes_rcvd dc(dstip) AS fortigates_touched values(dstip) AS fortigates values(action) AS actions min(_time) AS first_seen max(_time) AS last_seen BY srcip | convert ctime(first_seen) ctime(last_seen)Microsoft KQL
let ApprovedFortiManagers = dynamic(['198.51.100.10']);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor =~ 'Fortinet' and DeviceProduct =~ 'Fortigate'
| where DestinationPort == 541
| where SourceIP !in (ApprovedFortiManagers)
| summarize Attempts = count(), FortiGatesTouched = dcount(DestinationIP), Targets = make_set(DestinationIP, 25), Actions = make_set(DeviceAction, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIPSigma
title: FGFM Connection From Non-FortiManager Source - CVE-2024-26009
id: 0d7a95c4-61e2-4b38-a7f0-c94e18b2d5f6
status: experimental
description: Detects connections to the FGFM management port (TCP 541) from a host other than the approved FortiManager, a possible attempt to exploit the CVE-2024-26009 FGFM authentication bypass.
references:
- https://cert-portal.siemens.com/productcert/html/ssa-366067.html
- https://www.fortiguard.com/psirt/FG-IR-24-042
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
- attack.initial_access
- attack.t1190
- attack.lateral_movement
- attack.t1210
- attack.t1133
- cve.2024.26009
logsource:
category: firewall
product: fortigate
detection:
selection:
dst_port: 541
filter_fortimanager:
src_ip:
- '198.51.100.10'
condition: selection and not filter_fortimanager
falsepositives:
- Standby or secondary FortiManager and FortiAnalyzer appliances not yet in the allow-list
- Vulnerability scanners probing management ports
level: highKnown false positives:
- Secondary or DR FortiManager/FortiAnalyzer hosts missing from the allow-list
- Internal vulnerability scanners probing management ports
Tuning notes: Replace the documentation address 198.51.100.10 with your real FortiManager addresses (ideally a lookup or watchlist). Enable local-traffic logging so sessions to the firewall itself are recorded. Restrict FGFM with local-in policies and treat the FortiManager serial number as sensitive.
- FortiOS Proxy Daemon (wad) Crash on SSL Deep Inspection Path (CVE-2023-33308) — Exploitation · unlock with TL Creds
- FortiOS Administrator or Access-Profile Change by Unapproved Account (CVE-2023-41841) — Post-Exploitation · unlock with TL Creds
- FortiOS SSLVPN Session Surviving Password Change (CVE-2025-62631) — Persistent Remote Access · unlock with TL Creds
- Successful FortiOS Admin Login From Non-Private Source Address — Exposed Management Plane · unlock with TL Creds
- FortiOS Interface Allowaccess Changed to Expose Admin or Management Services · unlock with TL Creds
- FortiOS SSL Inspection Profile Modified (CVE-2023-33308 Workaround Regression) · unlock with TL Creds
- FortiOS httpsd Crash With External Admin Interface Access (CVE-2023-25610) — Exploitation · unlock with TL Creds
- FortiOS CLI Path Traversal Command (CVE-2022-41328) — Post-Exploitation · unlock with TL Creds
Indicators of compromise for TL-2026-5305
As of 2026-11-05, Threadlinqs Intelligence tracks 6 indicators of compromise for TL-2026-5305.
How Multiple Vulnerabilities in Fortigate NGFW Before V7.4.1 on works
Siemens ProductCERT advisory SSA-366067 (initial publication 2024-03-12, revision V1.7 on 2026-01-13) covers the Fortinet Fortigate Next-Generation Firewall (NGFW) application hosted on the Siemens RUGGEDCOM APE1808 industrial application-hosting platform. All RUGGEDCOM APE1808 devices running Fortinet NGFW before V7.4.1 are affected. The advisory aggregates a large set of upstream Fortinet FortiOS CVEs (the hunt skeleton lists 43 CVE identifiers from 2022 to 2025; the fetched advisory text refers to 44 vulnerabilities, so the exact count differs by revision). Revision V1.7 added CVE-2025-62631 (insufficient session expiration).
The most severe items are network-reachable and require no authentication. CVE-2023-25610 (CVSS v3.1 9.8, CWE-124 buffer underwrite) is a heap buffer underflow in the administrative interface of FortiOS and other Fortinet products. Crafted requests can give a remote unauthenticated attacker arbitrary code execution, or a DoS of the GUI. Fortinet's workaround is to disable HTTP/HTTPS administrative access or restrict it by IP. At publication (2023-03-07) Fortinet was not aware of in-the-wild exploitation. CVE-2023-33308 (CVSS 9.8, CWE-787/CWE-121) is a stack-based overflow in FortiOS 7.0.0-7.0.10 and 7.2.0-7.2.3 (and FortiProxy). It is triggered by crafted packets reaching proxy policies, or firewall policies in proxy mode with deep or full SSL inspection, and the workaround is to disable HTTP/2 on SSL inspection profiles used by proxy policies. No exploitation was reported when Fortinet published on 2023-07-11.
CVE-2024-26009 (CVSS 8.1, CWE-288) is an authentication bypass in the FGFM protocol. An unauthenticated attacker who knows the serial number of the managing FortiManager can send malicious FGFM requests and seize control of a managed device. Fortinet lists no workaround and no known exploitation. Other items in the advisory include CVE-2023-41841 (improper authorization, prof-admin profile performing elevated actions, 8.1), CVE-2023-29183 (authenticated XSS, 8.0) and CVE-2025-62631 (SSLVPN session not invalidated after a password change, CVSS 5.6, Fortinet FG-IR-25-411).
Exploitation status: the Siemens advisory does not state active exploitation. A separate source (search results referencing CISA KEV) indicates that CVE-2022-41328, a FortiOS path-traversal flaw in the list, was added to the CISA KEV catalog on 2023-03-14 and Fortinet's own advisory marks it as known exploited. The KEV snapshot fetched (first 100,000 characters only) could not confirm the other CVEs, so the threat is rated ACTIVE on the strength of that single CVE. Because RUGGEDCOM APE1808 is used in industrial and OT networks, unpatched firewall instances at the edge or inside OT segments expose management planes and proxy inspection paths to remote attackers.
MITRE ATT&CK techniques by tactic:
Execution
T1059 Command and Scripting Interpreter
Defense Evasion
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
lateral-movement
T1550.004 Use Alternate Authentication Material: Web Session Cookie
Remediation for Multiple Vulnerabilities in Fortigate NGFW Before V7.4.1 on
Patches
- Update Fortinet NGFW on RUGGEDCOM APE1808 to V7.4.1 or later; contact Siemens customer support for update details
Immediate actions
- Disable the HTTP/HTTPS administrative interface on the Fortigate NGFW or restrict it by source IP (CVE-2023-25610 workaround)
- Disable HTTP/2 support on SSL inspection profiles used by proxy policies and firewall policies in proxy mode (CVE-2023-33308 workaround)
- Do not expose the NGFW management plane or FGFM to untrusted networks
Workarounds
- CVE-2023-25610: disable HTTP/HTTPS admin access or limit by IP via local-in policies
- CVE-2023-33308: set custom-deep-inspection profiles to HTTP/1.1 only (disable HTTP/2)
Longer-term hardening
- Restrict FortiManager/FGFM connectivity to known management hosts and treat the FortiManager serial number as sensitive (CVE-2024-26009)
- Follow Siemens Industrial Security operational guidelines for network segmentation of RUGGEDCOM APE1808 deployments
- Monitor Siemens ProductCERT and Fortinet PSIRT for further revisions of SSA-366067
Affected and fixed versions
- Siemens — RUGGEDCOM APE1808 (with Fortinet NGFW)
Vulnerable versions: All versions with Fortinet NGFW before V7.4.1
Fixed in: Fortinet NGFW V7.4.1 - Fortinet — FortiOS (upstream, CVE-2023-25610)
Vulnerable versions: 5.0.0 through 7.2.3
Fixed in: 7.2.4; 7.0.10; 6.4.12; 6.2.13 - Fortinet — FortiOS / FortiProxy (upstream, CVE-2023-33308)
Vulnerable versions: FortiOS 7.0.0-7.0.10; FortiOS 7.2.0-7.2.3; FortiProxy 7.0.0-7.0.9; FortiProxy 7.2.0-7.2.2
Fixed in: FortiOS 7.0.11; FortiOS 7.2.4; FortiProxy 7.0.10; FortiProxy 7.2.3
Timeline of Multiple Vulnerabilities in Fortigate NGFW Before V7.4.1 on
- Fortinet publishes FG-IR-23-001 for CVE-2023-25610 (heap buffer underflow in the admin interface, unauthenticated RCE/GUI DoS); Fortinet is not aware of in-the-wild exploitation. FG-IR-22-369 for CVE-2022-41328 (path traversal) is also published.
- CVE-2022-41328 (FortiOS path traversal) is added to the CISA KEV catalog (federal due date 2023-04-04), per KEV tracker search results.
- Fortinet publishes FG-IR-23-183 for CVE-2023-33308 (stack-based overflow in proxy-mode deep SSL inspection); no known exploitation at publication; workaround is to disable HTTP/2 on SSL inspection profiles.
- NVD publishes CVE-2023-33308 with CVSS v3.1 9.8 (CWE-787, CWE-121).
- locked-ioc-5 publishes SSA-366067 V1.0 for the Fortinet NGFW on RUGGEDCOM APE1808; fix is NGFW V7.4.1.
- NVD record for CVE-2023-25610 published (CVSS 9.8, CWE-124).
- Fortinet and NVD publish CVE-2024-26009 (FGFM authentication bypass, CVSS 8.1, CWE-288); no workaround and no known exploitation.
- Siemens releases SSA-366067 V1.7, adding CVE-2025-62631 (insufficient session expiration in FortiOS SSLVPN).
Sources cited for Multiple Vulnerabilities in Fortigate NGFW Before V7.4.1 on
- Siemens Security Advisory SSA-366067 (last updated 2026-01-13) cert-portal.siemens.com · Advisory · 2024-03-12
- NVD CVE-2023-25610 NVD (NIST) · Advisory · 2025-03-24
- NVD CVE-2023-33308 NVD (NIST) · Advisory · 2023-07-26
- NVD CVE-2024-26009 NVD (NIST) · Advisory · 2025-08-12
- NVD CVE-2025-62631 NVD (NIST) · Advisory
- CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2023-03-14
- Fortinet PSIRT FG-IR-23-001 (CVE-2023-25610) FortiGuard Labs · Vendor report · 2023-03-07
- Fortinet PSIRT FG-IR-23-183 (CVE-2023-33308) FortiGuard Labs · Vendor report · 2023-07-11
- Fortinet PSIRT FG-IR-24-042 (CVE-2024-26009) FortiGuard Labs · Vendor report · 2025-08-12
- Fortinet PSIRT FG-IR-22-369 (CVE-2022-41328) FortiGuard Labs · Vendor report · 2023-03-07
Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.
