Siemens SSA-364175: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 (CVE-2024-3596, CVE-2025-4231 and others)

Key facts for TL-2026-5479

Detection coverage for TL-2026-5479

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5479 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PAN-OS Management Interface Command Injection Artifacts (CVE-2025-4231) — Exploitation

Detects shell metacharacters and command-chaining strings (command substitution, ';sh', '|bash', '&& curl', /dev/tcp) in PAN-OS config and system log fields on Palo Alto Networks Virtual NGFW (RUGGEDCOM APE1808, Siemens SSA-364175, TL-2026-5479). CVE-2025-4231 is an authenticated management web interface command injection that runs actions as root; Palo Alto reports no known exploitation, so this is a hunting/alerting baseline for early abuse.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059, T1068
• Data sources: pan:config, pan:system, PAN-OS management web interface
• Severity: high
• Confidence: high

Splunk SPL

index=pan_logs (sourcetype="pan:config" OR sourcetype="pan:system") earliest=-24h
| eval blob=lower(coalesce(cmd,"")." ".coalesce(path,"")." ".coalesce(after_change_detail,"")." ".coalesce(description,"")." ".coalesce(opaque,""))
| where match(blob, "(\x24\x28|\x60|;\s*(sh|bash|curl|wget|nc|python|perl|chmod)\b|\|\s*(sh|bash)\b|&&\s*(sh|bash|curl|wget)|/bin/(sh|bash)|/dev/tcp/)")
| stats count min(_time) as first_seen max(_time) as last_seen values(admin) as admin values(client) as client values(path) as path by host
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor == "Palo Alto Networks" and DeviceProduct == "PAN-OS"
| where Activity in ("CONFIG", "SYSTEM")
| extend raw = strcat(Message, " ", AdditionalExtensions)
| where raw matches regex @"(\$\(|`|;\s*(sh|bash|curl|wget|nc|python|perl|chmod)\b|\|\s*(sh|bash)\b|&&\s*(sh|bash|curl|wget)|/bin/(sh|bash)|/dev/tcp/)"
| project TimeGenerated, DeviceName, Activity, SourceIP, SourceUserName, Message, AdditionalExtensions
| order by TimeGenerated desc

Sigma

title: PAN-OS Management Interface Command Injection Artifacts CVE-2025-4231
id: 5f3c1a52-8b1e-4c7d-9a3e-2d6b7e1f0a01
status: experimental
description: Detects shell metacharacters in PAN-OS configuration log fields consistent with command injection through the management web interface (CVE-2025-4231).
references:
    - https://cert-portal.siemens.com/productcert/html/ssa-364175.html
    - https://security.paloaltonetworks.com/CVE-2025-4231
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/07
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059
    - attack.privilege-escalation
    - attack.t1068
    - cve.2025.4231
logsource:
    product: paloalto
    service: config
detection:
    selection_path:
        path|contains:
            - '$('
            - '`'
            - ';sh'
            - ';bash'
            - ';curl'
            - ';wget'
            - '|sh'
            - '|bash'
            - '&&curl'
            - '&&wget'
            - '/bin/sh'
            - '/dev/tcp/'
    selection_cmd:
        cmd|contains:
            - '$('
            - '`'
            - ';sh'
            - ';bash'
            - ';curl'
            - ';wget'
            - '|sh'
            - '|bash'
            - '&&curl'
            - '&&wget'
            - '/bin/sh'
            - '/dev/tcp/'
    selection_detail:
        after_change_detail|contains:
            - '$('
            - '`'
            - ';sh'
            - ';bash'
            - ';curl'
            - ';wget'
            - '|sh'
            - '|bash'
            - '&&curl'
            - '&&wget'
            - '/bin/sh'
            - '/dev/tcp/'
    condition: 1 of selection_*
falsepositives:
    - Administrators pasting scripts or pipes into configuration descriptions or custom report queries
    - Vulnerability scanners exercising the management interface
level: high

Known false positives:

• Administrators placing pipes or semicolons in object descriptions, custom report queries or commit comments
• Authorized vulnerability scans against the management interface

Tuning notes: Scope to Virtual NGFW hosts on RUGGEDCOM APE1808, exclude known change-automation accounts via the admin field, and adjust the pan_logs index name to match your Palo Alto Networks Add-on deployment. Pair with management-interface source IP allow-listing.

• 🔒 PAN-OS Management Interface Login From Outside Trusted Ranges (CVE-2025-4231, CVE-2024-3596) — Exploitation · unlock with TL Creds
• 🔒 PAN-OS RADIUS Admin Authentication Failure Burst Followed by Success (CVE-2024-3596 BlastRADIUS) — Credential Access · unlock with TL Creds
• 🔒 GlobalProtect Portal/Gateway Packet Flood From Single Source (CVE-2025-0114) — Impact · unlock with TL Creds
• 🔒 SSH Sessions Negotiating Terrapin-Vulnerable Algorithms to Network Devices (CVE-2023-48795) — Exposure · unlock with TL Creds
• 🔒 PAN-OS RADIUS, Authentication or SSH Profile Modification — Authentication Weakening · unlock with TL Creds
• 🔒 PAN-OS Configuration Containing Script Markup (CVE-2024-5920 Stored XSS) — Administrator Impersonation · unlock with TL Creds
• 🔒 PAN-OS XML API Changes to Admin, Authentication or SSH Configuration (CVE-2024-9471) — Post-Exploitation · unlock with TL Creds
• 🔒 PAN-OS Dataplane Crash, Reboot or Maintenance Mode (CVE-2024-9468, CVE-2025-4619) — Impact · unlock with TL Creds

Indicators of compromise for TL-2026-5479

As of 2026-11-07, Threadlinqs Intelligence tracks 6 indicators of compromise for TL-2026-5479.

How Siemens SSA-364175 works

Siemens ProductCERT first published SSA-364175 on 2024-07-09 and has extended it eight times as Palo Alto Networks disclosed further PAN-OS flaws. The advisory covers RUGGEDCOM APE1808 industrial edge devices running the Palo Alto Networks Virtual NGFW at versions before V11.1.4-h1. Siemens recommends upgrading to V11.1.4-h1 (contact Siemens support for patch distribution) and applying product-specific mitigations. Some CVEs apply only to specific configurations: Terrapin (CVE-2023-48795) needs ChaCha20-Poly1305 or Encrypt-then-MAC algorithms in SSH; CVE-2025-0114 needs GlobalProtect portal/gateway enabled; CVE-2025-4619 needs URL proxy or decrypt-policy configuration.

The advisory's nine CVEs fall into four groups. (1) Authentication and protocol weaknesses: CVE-2024-3596 (BlastRADIUS, CWE-924 in Siemens' listing; PAN lists CWE-290), where a man-in-the-middle between PAN-OS and a RADIUS server can forge a valid Access-Accept using an MD5 chosen-prefix collision and escalate to superuser when CHAP or PAP is used. CVE-2023-48795 (Terrapin, CWE-222) is an SSH prefix-truncation attack against ChaCha20-Poly1305 and CBC with Encrypt-then-MAC that bypasses integrity checks during the handshake. (2) Privilege escalation and command execution: CVE-2025-4231 (CWE-77), a command injection in the management web interface that lets an authenticated administrator run actions as root. CVE-2024-9471 (CWE-269) lets a restricted administrator exceed their role through the XML API using a compromised key. CVE-2024-5913 (CWE-20) allows privilege elevation through physical file system access. (3) Stored XSS: CVE-2024-5920 (CWE-79) lets an authenticated Panorama administrator inject code into configurations and impersonate other PAN-OS administrators. (4) Denial of service: CVE-2024-9468 (CWE-787, memory corruption via dataplane packets), CVE-2025-0114 (CWE-400, GlobalProtect packet flooding) and CVE-2025-4619 (CWE-754, malicious dataplane packet reboots the firewall). For CVE-2024-9468 and CVE-2025-4619, repeated attempts force PAN-OS into maintenance mode.

Exploitation status: Palo Alto Networks states it is not aware of malicious exploitation of CVE-2025-4231, CVE-2025-0114, CVE-2025-4619, CVE-2024-9468, CVE-2024-9471, CVE-2024-5913 or CVE-2024-5920. For CVE-2024-3596, PAN notes that proof-of-concept code demonstrating exploitation exists; the BlastRADIUS project publishes a demonstration script with collision examples but not full end-to-end exploit code. The Terrapin authors publish a vulnerability scanner but no full attack implementation. A partial read of the CISA KEV catalog did not show any of the nine CVEs, but the whole catalog was not reviewed. No IOCs, threat actor or campaign are attributed to these CVEs in the sources. Vendor CVSS scores differ by source: Siemens lists v3.1 scores of 9.1 (CVE-2025-4231) and 9.0 (CVE-2024-3596), while PAN uses CVSS v4.0 and rates the same CVEs 6.1 and 5.3 respectively. Defenders of OT environments should treat the management plane and RADIUS path as the key exposure points.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Impact

T1499.004 Endpoint Denial of Service: Application or System Exploitation; T1565.002 Data Manipulation: Transmitted Data Manipulation

Credential Access

T1556 Modify Authentication Process; T1557 Adversary-in-the-Middle

Remediation for Siemens SSA-364175

Patches

• Upgrade Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 to V11.1.4-h1 (contact Siemens customer support for patch distribution)

Immediate actions

• Restrict management web interface and management interface access to trusted internal IP addresses (CVE-2025-4231, CVE-2024-3596)
• Configure RADIUS servers to require the Message-Authenticator attribute and enable radius-require-msg-authentic where the RADIUS server supports it
• Restrict RADIUS traffic to a management network or dedicated VLAN
• Configure the SSH profile to remove ChaCha20-Poly1305 and Encrypt-then-MAC ciphers/MACs (CVE-2023-48795)

Workarounds

• Limit management interface access to trusted IP addresses
• Use SSH profile cipher and MAC restrictions to exclude vulnerable algorithms
• Require Message-Authenticator on RADIUS exchanges

Longer-term hardening

• Move RADIUS authentication to PEAP-MSCHAPv2, PEAP-GTC or EAP-TTLS instead of CHAP/PAP
• Follow Siemens operational guidelines for Industrial Security
• Review GlobalProtect, URL proxy and decrypt-policy exposure on Virtual NGFW instances

Affected and fixed versions

• Siemens — RUGGEDCOM APE1808 (with Palo Alto Networks Virtual NGFW)
  Vulnerable versions: All versions with Palo Alto Networks Virtual NGFW < V11.1.4-h1
  Fixed in: Palo Alto Networks Virtual NGFW V11.1.4-h1
• Palo Alto Networks — PAN-OS
  Vulnerable versions: Various 9.1, 10.1, 10.2, 11.0, 11.1 and 11.2 releases depending on CVE (see vendor advisories)
  Fixed in: Per CVE, e.g. 10.2.8, 11.0.3 (CVE-2025-4231); 11.1.3 (CVE-2024-9468, CVE-2024-3596)

Timeline of Siemens SSA-364175

• 2023-12-18 Ruhr University Bochum researchers publicly disclose the Terrapin SSH prefix-truncation attack (CVE-2023-48795) after coordinated disclosure begun 2023-10-17
• 2024-07-09 locked-ioc-3 publishes SSA-364175 V1.0 for locked-ioc-4 Virtual NGFW on locked-ioc-5
• 2024-07-10 locked-ioc-4 publishes advisories for CVE-2024-3596 (BlastRADIUS) and CVE-2024-5913
• 2024-08-13 Siemens V1.1 adds CVE-2024-5913 and CVE-2024-3596
• 2024-10-08 Siemens V1.2 adds CVE-2023-48795 and version fixes
• 2024-10-09 locked-ioc-4 publishes CVE-2024-9468 (dataplane memory corruption DoS) and CVE-2024-9471 (XML API privilege escalation)
• 2024-11-12 Siemens V1.3 adds CVE-2024-9468 and CVE-2024-9471 with CVSS v4.0 data
• 2024-11-13 locked-ioc-4 publishes CVE-2024-5920 (stored XSS enabling administrator impersonation)
• 2025-03-12 locked-ioc-4 publishes CVE-2025-0114 (GlobalProtect DoS)
• 2025-06-11 locked-ioc-4 publishes CVE-2025-4231 (authenticated management web interface command injection to root)
• 2025-07-08 Siemens V1.6 adds CVE-2025-4231
• 2025-11-12 locked-ioc-4 publishes CVE-2025-4619 (dataplane packet reboot DoS)
• 2026-01-13 Siemens V1.7 adds CVE-2025-4619; fixed version V11.1.4-h1 recommended

Sources cited for Siemens SSA-364175

• Siemens Security Advisory SSA-364175 cert-portal.siemens.com · Advisory · 2024-07-09
• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory
• Palo Alto Networks Security Advisory CVE-2025-4231 Palo Alto Networks · Vendor report · 2025-06-11
• Palo Alto Networks Security Advisory CVE-2024-3596 Palo Alto Networks · Vendor report · 2024-07-10
• Palo Alto Networks Security Advisory CVE-2025-0114 Palo Alto Networks · Vendor report · 2025-03-12
• Palo Alto Networks Security Advisory CVE-2025-4619 Palo Alto Networks · Vendor report · 2025-11-12
• Palo Alto Networks Security Advisory CVE-2024-9468 Palo Alto Networks · Vendor report · 2024-10-09
• Palo Alto Networks Security Advisory CVE-2024-9471 Palo Alto Networks · Vendor report · 2024-10-09
• Palo Alto Networks Security Advisory CVE-2024-5913 Palo Alto Networks · Vendor report · 2024-07-10
• Palo Alto Networks Security Advisory CVE-2024-5920 Palo Alto Networks · Vendor report · 2024-11-13
• BlastRADIUS: RADIUS/UDP vulnerable to MD5 collision attack (CVE-2024-3596) blastradius.fail · Research
• Terrapin Attack: SSH prefix truncation (CVE-2023-48795) terrapin-attack.com · Research · 2023-12-18

More in vulnerability

• Local Privilege Escalation in Siemens TeleControl Server Basic before V3.1.2.4 (CVE-2025-40942)
• Privilege Escalation in WIBU CodeMeter Runtime Affecting Siemens Desigo CC Product Family and SENTRON Powermanager (CVE-2025-47809)
• Siemens SSA-282044: DLL Hijacking in Siemens Web Installer (SIWA) used by Online Software Delivery (CVE-2025-30033)
• SSA-365200: Google Chrome V8 Type Confusion Vulnerability (CVE-2025-6554) in Siemens HyperLynx and Industrial Edge App Publisher
• PHP2Shell (CVE-2026-109618, CVE-2026-109619) and Node2Shell (CVE-2026-111497) exploited vulnerabilities; Insignary-Chk detection tool released