# Siemens SSA-364175: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 (CVE-2024-3596, CVE-2025-4231 and others)

> Siemens SSA-364175 (V1.7, updated 2026-01-13) aggregates nine PAN-OS vulnerabilities affecting the Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 devices prior to V11.1.4-h1. The highest Siemens-assigned CVSS v3.1 scores are 9.1 (CVE-2025-4231) and 9.0 (CVE-2024-3596, the BlastRADIUS flaw); Palo Alto Networks reports no known malicious exploitation, but a PoC demonstration exists for CVE-2024-3596.

- **Published:** 2026-11-07T04:24:43Z
- **Last reviewed:** 2026-11-07T04:24:43Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5479
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5479.png
- **ID:** TL-2026-5479
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 6
- **CVEs:** CVE-2023-48795, CVE-2024-3596, CVE-2024-5913, CVE-2024-5920, CVE-2024-9468, CVE-2024-9471, CVE-2025-0114, CVE-2025-4231, CVE-2025-4619

## Description

Siemens ProductCERT first published SSA-364175 on 2024-07-09 and has extended it eight times as Palo Alto Networks disclosed further PAN-OS flaws. The advisory covers RUGGEDCOM APE1808 industrial edge devices running the Palo Alto Networks Virtual NGFW at versions before V11.1.4-h1. Siemens recommends upgrading to V11.1.4-h1 (contact Siemens support for patch distribution) and applying product-specific mitigations. Some CVEs apply only to specific configurations: Terrapin (CVE-2023-48795) needs ChaCha20-Poly1305 or Encrypt-then-MAC algorithms in SSH; CVE-2025-0114 needs GlobalProtect portal/gateway enabled; CVE-2025-4619 needs URL proxy or decrypt-policy configuration.

The advisory's nine CVEs fall into four groups. (1) Authentication and protocol weaknesses: CVE-2024-3596 (BlastRADIUS, CWE-924 in Siemens' listing; PAN lists CWE-290), where a man-in-the-middle between PAN-OS and a RADIUS server can forge a valid Access-Accept using an MD5 chosen-prefix collision and escalate to superuser when CHAP or PAP is used. CVE-2023-48795 (Terrapin, CWE-222) is an SSH prefix-truncation attack against ChaCha20-Poly1305 and CBC with Encrypt-then-MAC that bypasses integrity checks during the handshake. (2) Privilege escalation and command execution: CVE-2025-4231 (CWE-77), a command injection in the management web interface that lets an authenticated administrator run actions as root. CVE-2024-9471 (CWE-269) lets a restricted administrator exceed their role through the XML API using a compromised key. CVE-2024-5913 (CWE-20) allows privilege elevation through physical file system access. (3) Stored XSS: CVE-2024-5920 (CWE-79) lets an authenticated Panorama administrator inject code into configurations and impersonate other PAN-OS administrators. (4) Denial of service: CVE-2024-9468 (CWE-787, memory corruption via dataplane packets), CVE-2025-0114 (CWE-400, GlobalProtect packet flooding) and CVE-2025-4619 (CWE-754, malicious dataplane packet reboots the firewall). For CVE-2024-9468 and CVE-2025-4619, repeated attempts force PAN-OS into maintenance mode.

Exploitation status: Palo Alto Networks states it is not aware of malicious exploitation of CVE-2025-4231, CVE-2025-0114, CVE-2025-4619, CVE-2024-9468, CVE-2024-9471, CVE-2024-5913 or CVE-2024-5920. For CVE-2024-3596, PAN notes that proof-of-concept code demonstrating exploitation exists; the BlastRADIUS project publishes a demonstration script with collision examples but not full end-to-end exploit code. The Terrapin authors publish a vulnerability scanner but no full attack implementation. A partial read of the CISA KEV catalog did not show any of the nine CVEs, but the whole catalog was not reviewed. No IOCs, threat actor or campaign are attributed to these CVEs in the sources. Vendor CVSS scores differ by source: Siemens lists v3.1 scores of 9.1 (CVE-2025-4231) and 9.0 (CVE-2024-3596), while PAN uses CVSS v4.0 and rates the same CVEs 6.1 and 5.3 respectively. Defenders of OT environments should treat the management plane and RADIUS path as the key exposure points.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1557 Adversary-in-the-Middle
- T1556 Modify Authentication Process
- T1565.002 Data Manipulation: Transmitted Data Manipulation
- T1499.004 Endpoint Denial of Service: Application or System Exploitation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**PAN-OS Management Interface Command Injection Artifacts (CVE-2025-4231) — Exploitation** (`TL-2026-5479-SPL-001`)

Detects shell metacharacters and command-chaining strings (command substitution, ';sh', '|bash', '&& curl', /dev/tcp) in PAN-OS config and system log fields on Palo Alto Networks Virtual NGFW (RUGGEDCOM APE1808, Siemens SSA-364175, TL-2026-5479). CVE-2025-4231 is an authenticated management web interface command injection that runs actions as root; Palo Alto reports no known exploitation, so this is a hunting/alerting baseline for early abuse.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059, T1068
- **Data sources:** pan:config, pan:system, PAN-OS management web interface
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=pan_logs (sourcetype="pan:config" OR sourcetype="pan:system") earliest=-24h
| eval blob=lower(coalesce(cmd,"")." ".coalesce(path,"")." ".coalesce(after_change_detail,"")." ".coalesce(description,"")." ".coalesce(opaque,""))
| where match(blob, "(\x24\x28|\x60|;\s*(sh|bash|curl|wget|nc|python|perl|chmod)\b|\|\s*(sh|bash)\b|&&\s*(sh|bash|curl|wget)|/bin/(sh|bash)|/dev/tcp/)")
| stats count min(_time) as first_seen max(_time) as last_seen values(admin) as admin values(client) as client values(path) as path by host
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor == "Palo Alto Networks" and DeviceProduct == "PAN-OS"
| where Activity in ("CONFIG", "SYSTEM")
| extend raw = strcat(Message, " ", AdditionalExtensions)
| where raw matches regex @"(\$\(|`|;\s*(sh|bash|curl|wget|nc|python|perl|chmod)\b|\|\s*(sh|bash)\b|&&\s*(sh|bash|curl|wget)|/bin/(sh|bash)|/dev/tcp/)"
| project TimeGenerated, DeviceName, Activity, SourceIP, SourceUserName, Message, AdditionalExtensions
| order by TimeGenerated desc
```

### Sigma

```yaml
title: PAN-OS Management Interface Command Injection Artifacts CVE-2025-4231
id: 5f3c1a52-8b1e-4c7d-9a3e-2d6b7e1f0a01
status: experimental
description: Detects shell metacharacters in PAN-OS configuration log fields consistent with command injection through the management web interface (CVE-2025-4231).
references:
    - https://cert-portal.siemens.com/productcert/html/ssa-364175.html
    - https://security.paloaltonetworks.com/CVE-2025-4231
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/07
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059
    - attack.privilege-escalation
    - attack.t1068
    - cve.2025.4231
logsource:
    product: paloalto
    service: config
detection:
    selection_path:
        path|contains:
            - '$('
            - '`'
            - ';sh'
            - ';bash'
            - ';curl'
            - ';wget'
            - '|sh'
            - '|bash'
            - '&&curl'
            - '&&wget'
            - '/bin/sh'
            - '/dev/tcp/'
    selection_cmd:
        cmd|contains:
            - '$('
            - '`'
            - ';sh'
            - ';bash'
            - ';curl'
            - ';wget'
            - '|sh'
            - '|bash'
            - '&&curl'
            - '&&wget'
            - '/bin/sh'
            - '/dev/tcp/'
    selection_detail:
        after_change_detail|contains:
            - '$('
            - '`'
            - ';sh'
            - ';bash'
            - ';curl'
            - ';wget'
            - '|sh'
            - '|bash'
            - '&&curl'
            - '&&wget'
            - '/bin/sh'
            - '/dev/tcp/'
    condition: 1 of selection_*
falsepositives:
    - Administrators pasting scripts or pipes into configuration descriptions or custom report queries
    - Vulnerability scanners exercising the management interface
level: high

```

**Known false positives:**

- Administrators placing pipes or semicolons in object descriptions, custom report queries or commit comments
- Authorized vulnerability scans against the management interface

**Tuning notes:** Scope to Virtual NGFW hosts on RUGGEDCOM APE1808, exclude known change-automation accounts via the admin field, and adjust the pan_logs index name to match your Palo Alto Networks Add-on deployment. Pair with management-interface source IP allow-listing.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- PAN-OS Management Interface Login From Outside Trusted Ranges (CVE-2025-4231, CVE-2024-3596) — Exploitation (locked: unlock with TL Creds)
- PAN-OS RADIUS Admin Authentication Failure Burst Followed by Success (CVE-2024-3596 BlastRADIUS) — Credential Access (locked: unlock with TL Creds)
- GlobalProtect Portal/Gateway Packet Flood From Single Source (CVE-2025-0114) — Impact (locked: unlock with TL Creds)
- SSH Sessions Negotiating Terrapin-Vulnerable Algorithms to Network Devices (CVE-2023-48795) — Exposure (locked: unlock with TL Creds)
- PAN-OS RADIUS, Authentication or SSH Profile Modification — Authentication Weakening (locked: unlock with TL Creds)
- PAN-OS Configuration Containing Script Markup (CVE-2024-5920 Stored XSS) — Administrator Impersonation (locked: unlock with TL Creds)
- PAN-OS XML API Changes to Admin, Authentication or SSH Configuration (CVE-2024-9471) — Post-Exploitation (locked: unlock with TL Creds)
- PAN-OS Dataplane Crash, Reboot or Maintenance Mode (CVE-2024-9468, CVE-2025-4619) — Impact (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Siemens Security Advisory SSA-364175](https://cert-portal.siemens.com/productcert/html/ssa-364175.html)
- [Palo Alto Networks Security Advisory CVE-2025-4231](https://security.paloaltonetworks.com/CVE-2025-4231)
- [Palo Alto Networks Security Advisory CVE-2024-3596](https://security.paloaltonetworks.com/CVE-2024-3596)
- [Palo Alto Networks Security Advisory CVE-2025-0114](https://security.paloaltonetworks.com/CVE-2025-0114)
- [Palo Alto Networks Security Advisory CVE-2025-4619](https://security.paloaltonetworks.com/CVE-2025-4619)
- [Palo Alto Networks Security Advisory CVE-2024-9468](https://security.paloaltonetworks.com/CVE-2024-9468)
- [Palo Alto Networks Security Advisory CVE-2024-9471](https://security.paloaltonetworks.com/CVE-2024-9471)
- [Palo Alto Networks Security Advisory CVE-2024-5913](https://security.paloaltonetworks.com/CVE-2024-5913)
- [Palo Alto Networks Security Advisory CVE-2024-5920](https://security.paloaltonetworks.com/CVE-2024-5920)
- [BlastRADIUS: RADIUS/UDP vulnerable to MD5 collision attack (CVE-2024-3596)](https://www.blastradius.fail/)
- [Terrapin Attack: SSH prefix truncation (CVE-2023-48795)](https://terrapin-attack.com/)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5479