Threat video1:00
Siemens SSA-364175 APE1808 PAN-OS Flaws: Detection & IOCs
Nine PAN-OS flaws in Virtual NGFW on RUGGEDCOM APE1808 reach CVSS 9.1. The page maps 6 IOCs and 9 detection rules, including a free Splunk SPL rule.
Read the full threat intel for Siemens SSA-364175: Multiple Vulnerabilities in Palo Alto Networks… →
Chapters
- 0:00The hookNine critical firewall vulnerabilities.
- 0:04The storySiemens extended the advisory eight times.
- 0:11Attack pathForged RADIUS messages escalate privileges.
- 0:26AttributionNo threat actor: this was defensive research.
- 0:31Indicators of compromiseNo malicious indicators were published.
- 0:37MITRE ATT&CK techniques7 ATT&CK techniques, from initial access to impact.
- 0:42Remediation4 steps now: Restrict management web interface and management interface access to trusted.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Nine critical firewall vulnerabilities.
0:05Siemens extended the advisory eight times.
0:08Latest includes command injection.
0:11Forged RADIUS messages escalate privileges.
0:15Command injection runs as root.
0:17Crafted packets reboot the firewall.
0:19Siemens released patched version 11.1.
0:27No threat actor: this was defensive research.
0:32No malicious indicators were published.
0:387 ATT&CK techniques, from initial access to impact.
0:434 steps now: Restrict management web interface and management interface access to trusted.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.