# Multiple Vulnerabilities in Fortigate NGFW Before V7.4.1 on Siemens RUGGEDCOM APE1808 Devices (SSA-366067)

> Siemens ProductCERT advisory SSA-366067 reports dozens of Fortinet FortiOS/NGFW CVEs affecting RUGGEDCOM APE1808 devices running Fortinet NGFW before V7.4.1, including unauthenticated remote code execution (CVE-2023-25610, CVE-2023-33308) and an FGFM authentication bypass (CVE-2024-26009). Siemens' remediation is to update the Fortigate NGFW to V7.4.1.

- **Published:** 2026-11-05T07:12:05Z
- **Last reviewed:** 2026-11-05T07:12:05Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5305
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5305.png
- **ID:** TL-2026-5305
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 6
- **CVEs:** CVE-2022-39948, CVE-2022-41327, CVE-2022-41328, CVE-2022-41329, CVE-2022-41330, CVE-2022-41334, CVE-2022-42469, CVE-2022-42474, CVE-2022-42476, CVE-2022-43947, CVE-2022-43953, CVE-2022-45861, CVE-2023-22639, CVE-2023-22640, CVE-2023-22641, CVE-2023-25610, CVE-2023-26207, CVE-2023-28001, CVE-2023-28002, CVE-2023-29175, CVE-2023-29178, CVE-2023-29179, CVE-2023-29180, CVE-2023-29181, CVE-2023-29183, CVE-2023-29184, CVE-2023-33301, CVE-2023-33305, CVE-2023-33306, CVE-2023-33307, CVE-2023-33308, CVE-2023-36555, CVE-2023-36639, CVE-2023-36641, CVE-2023-37930, CVE-2023-37935, CVE-2023-40718, CVE-2023-41675, CVE-2023-41841, CVE-2023-45584, CVE-2024-26009, CVE-2025-47294, CVE-2025-62631

## Description

Siemens ProductCERT advisory SSA-366067 (initial publication 2024-03-12, revision V1.7 on 2026-01-13) covers the Fortinet Fortigate Next-Generation Firewall (NGFW) application hosted on the Siemens RUGGEDCOM APE1808 industrial application-hosting platform. All RUGGEDCOM APE1808 devices running Fortinet NGFW before V7.4.1 are affected. The advisory aggregates a large set of upstream Fortinet FortiOS CVEs (the hunt skeleton lists 43 CVE identifiers from 2022 to 2025; the fetched advisory text refers to 44 vulnerabilities, so the exact count differs by revision). Revision V1.7 added CVE-2025-62631 (insufficient session expiration).

The most severe items are network-reachable and require no authentication. CVE-2023-25610 (CVSS v3.1 9.8, CWE-124 buffer underwrite) is a heap buffer underflow in the administrative interface of FortiOS and other Fortinet products. Crafted requests can give a remote unauthenticated attacker arbitrary code execution, or a DoS of the GUI. Fortinet's workaround is to disable HTTP/HTTPS administrative access or restrict it by IP. At publication (2023-03-07) Fortinet was not aware of in-the-wild exploitation. CVE-2023-33308 (CVSS 9.8, CWE-787/CWE-121) is a stack-based overflow in FortiOS 7.0.0-7.0.10 and 7.2.0-7.2.3 (and FortiProxy). It is triggered by crafted packets reaching proxy policies, or firewall policies in proxy mode with deep or full SSL inspection, and the workaround is to disable HTTP/2 on SSL inspection profiles used by proxy policies. No exploitation was reported when Fortinet published on 2023-07-11.

CVE-2024-26009 (CVSS 8.1, CWE-288) is an authentication bypass in the FGFM protocol. An unauthenticated attacker who knows the serial number of the managing FortiManager can send malicious FGFM requests and seize control of a managed device. Fortinet lists no workaround and no known exploitation. Other items in the advisory include CVE-2023-41841 (improper authorization, prof-admin profile performing elevated actions, 8.1), CVE-2023-29183 (authenticated XSS, 8.0) and CVE-2025-62631 (SSLVPN session not invalidated after a password change, CVSS 5.6, Fortinet FG-IR-25-411).

Exploitation status: the Siemens advisory does not state active exploitation. A separate source (search results referencing CISA KEV) indicates that CVE-2022-41328, a FortiOS path-traversal flaw in the list, was added to the CISA KEV catalog on 2023-03-14 and Fortinet's own advisory marks it as known exploited. The KEV snapshot fetched (first 100,000 characters only) could not confirm the other CVEs, so the threat is rated ACTIVE on the strength of that single CVE. Because RUGGEDCOM APE1808 is used in industrial and OT networks, unpatched firewall instances at the edge or inside OT segments expose management planes and proxy inspection paths to remote attackers.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1078 Valid Accounts
- T1550.004 Use Alternate Authentication Material: Web Session Cookie

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**FGFM (TCP/541) Connection From Non-FortiManager Host (CVE-2024-26009) — Lateral Movement** (`TL-2026-5305-SPL-003`)

Detects FGFM (FortiGate-FortiManager protocol, TCP 541) sessions from hosts that are not the approved FortiManager. CVE-2024-26009 is an FGFM authentication bypass (CVSS 8.1) where an unauthenticated attacker who knows the managing FortiManager serial number can send crafted FGFM requests and take control of a managed device. Fortinet offers no workaround, so network-level detection and restriction matter.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1210, T1133
- **Data sources:** fortigate_traffic, CommonSecurityLog
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=fortinet sourcetype="fortigate_traffic" earliest=-24h dstport=541 NOT srcip IN ("198.51.100.10") | stats count sum(sentbyte) AS bytes_sent sum(rcvdbyte) AS bytes_rcvd dc(dstip) AS fortigates_touched values(dstip) AS fortigates values(action) AS actions min(_time) AS first_seen max(_time) AS last_seen BY srcip | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let ApprovedFortiManagers = dynamic(['198.51.100.10']);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor =~ 'Fortinet' and DeviceProduct =~ 'Fortigate'
| where DestinationPort == 541
| where SourceIP !in (ApprovedFortiManagers)
| summarize Attempts = count(), FortiGatesTouched = dcount(DestinationIP), Targets = make_set(DestinationIP, 25), Actions = make_set(DeviceAction, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP
```

### Sigma

```yaml
title: FGFM Connection From Non-FortiManager Source - CVE-2024-26009
id: 0d7a95c4-61e2-4b38-a7f0-c94e18b2d5f6
status: experimental
description: Detects connections to the FGFM management port (TCP 541) from a host other than the approved FortiManager, a possible attempt to exploit the CVE-2024-26009 FGFM authentication bypass.
references:
    - https://cert-portal.siemens.com/productcert/html/ssa-366067.html
    - https://www.fortiguard.com/psirt/FG-IR-24-042
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
    - attack.initial_access
    - attack.t1190
    - attack.lateral_movement
    - attack.t1210
    - attack.t1133
    - cve.2024.26009
logsource:
    category: firewall
    product: fortigate
detection:
    selection:
        dst_port: 541
    filter_fortimanager:
        src_ip:
            - '198.51.100.10'
    condition: selection and not filter_fortimanager
falsepositives:
    - Standby or secondary FortiManager and FortiAnalyzer appliances not yet in the allow-list
    - Vulnerability scanners probing management ports
level: high
```

**Known false positives:**

- Secondary or DR FortiManager/FortiAnalyzer hosts missing from the allow-list
- Internal vulnerability scanners probing management ports

**Tuning notes:** Replace the documentation address 198.51.100.10 with your real FortiManager addresses (ideally a lookup or watchlist). Enable local-traffic logging so sessions to the firewall itself are recorded. Restrict FGFM with local-in policies and treat the FortiManager serial number as sensitive.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- FortiOS Proxy Daemon (wad) Crash on SSL Deep Inspection Path (CVE-2023-33308) — Exploitation (locked: unlock with TL Creds)
- FortiOS Administrator or Access-Profile Change by Unapproved Account (CVE-2023-41841) — Post-Exploitation (locked: unlock with TL Creds)
- FortiOS SSLVPN Session Surviving Password Change (CVE-2025-62631) — Persistent Remote Access (locked: unlock with TL Creds)
- Successful FortiOS Admin Login From Non-Private Source Address — Exposed Management Plane (locked: unlock with TL Creds)
- FortiOS Interface Allowaccess Changed to Expose Admin or Management Services (locked: unlock with TL Creds)
- FortiOS SSL Inspection Profile Modified (CVE-2023-33308 Workaround Regression) (locked: unlock with TL Creds)
- FortiOS httpsd Crash With External Admin Interface Access (CVE-2023-25610) — Exploitation (locked: unlock with TL Creds)
- FortiOS CLI Path Traversal Command (CVE-2022-41328) — Post-Exploitation (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Siemens Security Advisory SSA-366067 (last updated 2026-01-13)](https://cert-portal.siemens.com/productcert/html/ssa-366067.html)
- [Fortinet PSIRT FG-IR-23-001 (CVE-2023-25610)](https://www.fortiguard.com/psirt/FG-IR-23-001)
- [Fortinet PSIRT FG-IR-23-183 (CVE-2023-33308)](https://www.fortiguard.com/psirt/FG-IR-23-183)
- [Fortinet PSIRT FG-IR-24-042 (CVE-2024-26009)](https://www.fortiguard.com/psirt/FG-IR-24-042)
- [Fortinet PSIRT FG-IR-22-369 (CVE-2022-41328)](https://www.fortiguard.com/psirt/FG-IR-22-369)
- [NVD CVE-2023-25610](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-25610)
- [NVD CVE-2023-33308](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-33308)
- [NVD CVE-2024-26009](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-26009)
- [NVD CVE-2025-62631](https://nvd.nist.gov/vuln/detail/cve-2025-62631)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5305