Skip to navigation

Threat reportVulnerabilityTL-2026-5491

Siemens SSA-698820: Multiple Fortigate NGFW Vulnerabilities (before V7.4.4) on RUGGEDCOM APE1808 Devices

highPATCHED

Siemens ProductCERT advisory SSA-698820 aggregates 14 Fortinet FortiOS vulnerabilities (stack-based buffer overflows, session fixation, XSS, missing authentication, fgfm daemon flaws and log-file information disclosure) affecting the Fortigate NGFW running on RUGGEDCOM APE1808 devices in all versions prior to V7.4.4. Siemens recommends updating Fortigate NGFW to V7.4.4. First disclosed .

Key facts for RUGGEDCOM APE1808 FortiGate flaws

IdentifiersTL-2026-5491, CVE-2024-21754, CVE-2023-46720, CVE-2024-23111, CVE-2024-26010, CVE-2024-26006, CVE-2024-26015, CVE-2024-36505, CVE-2024-33510, CVE-2023-50176, CVE-2024-26011, CVE-2025-47295, CVE-2024-50568, CVE-2024-26008, CVE-2024-47570
Also known asSSA-698820
SeverityHIGH
CVSS7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
First disclosed
Exploitation statusNo known exploitation
EPSSCVE-2024-26011: 0.5% (46.9th percentile); CVE-2024-26008: 0.5% (47.5th percentile)
Affected productsSiemens RUGGEDCOM APE1808 (Fortigate NGFW); Fortinet FortiOS
Weaknesses (CWE)CWE-121, CWE-787, CWE-384, CWE-916, CWE-79, CWE-703, CWE-754, CWE-306, CWE-1389, CWE-358
MITRE ATT&CK techniquesT1059 Command and Scripting Interpreter, T1078 Valid Accounts, T1190 Exploit Public-Facing Application, T1204.001 User Execution: Malicious Link, T1212 Exploitation for Credential Access, T1499.004 Application or System Exploitation, T1528 Steal Application Access Token, T1539 Steal Web Session Cookie, T1552 Unsecured Credentials, T1685 Disable or Modify Tools
MotivationUNKNOWN
Target sectorsindustrial, energy, transport, critical-infrastructure, manufacturing
Target regionsGlobal
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage for RUGGEDCOM APE1808 FortiGate flaws

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5491 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5491 FortiGate fgfmd Crash or Restart (CVE-2024-26010 / CVE-2025-47295 Exploitation Attempt)

Detects FortiGate (Fortigate NGFW on RUGGEDCOM APE1808, SSA-698820) event logs showing the fgfmd FortiGate-to-FortiManager daemon crashing, faulting or restarting. CVE-2024-26010 (stack-based buffer overflow), CVE-2024-26008 and CVE-2025-47295 (exception handling / buffer over-read) are all reached via crafted fgfm packets, so unexpected fgfmd crashes are the primary hunting signal for exploitation or fuzzing of the fgfm management channel.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1499.004, T1212
  • Data sources: fortinet:fgt_event, fortigate_event_logs, CommonSecurityLog
  • Severity: high
  • Confidence: medium

Splunk SPL

index=fortinet sourcetype="fgt_event" subtype=system (msg="*fgfmd*" OR logdesc="*fgfm*") (msg="*crash*" OR msg="*segfault*" OR msg="*signal 11*" OR msg="*killed*" OR msg="*restart*") | stats count min(_time) as first_seen max(_time) as last_seen values(msg) as messages by host devname | eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S") | table host devname count first_seen last_seen messages

Microsoft KQL

CommonSecurityLog | where TimeGenerated > ago(24h) | where DeviceVendor =~ "Fortinet" | where Message has "fgfmd" or Activity has "fgfmd" or AdditionalExtensions has "fgfmd" | where Message has_any ("crash", "segfault", "signal 11", "killed", "restart") | summarize Events = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Messages = make_set(Message, 10) by DeviceName | project DeviceName, Events, FirstSeen, LastSeen, Messages

Sigma

title: FortiGate fgfmd Daemon Crash or Restart (CVE-2024-26010)
id: 3b0f6a52-8c1e-4d7a-9a61-5e2f4c7d1a01
status: experimental
description: Detects fgfmd (FortiGate-to-FortiManager daemon) crashes or restarts on FortiGate NGFW, a signal of attempted exploitation of CVE-2024-26010, CVE-2024-26008 or CVE-2025-47295 via crafted fgfm packets (Siemens SSA-698820).
references:
    - https://cert-portal.siemens.com/productcert/html/ssa-698820.html
    - https://fortiguard.fortinet.com/psirt/FG-IR-24-036
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/07
tags:
    - attack.initial-access
    - attack.t1190
    - attack.impact
    - attack.t1499.004
    - attack.credential-access
    - attack.t1212
    - cve.2024-26010
    - cve.2024-26008
    - cve.2025-47295
logsource:
    product: fortigate
    service: event
detection:
    selection_process:
        msg|contains: 'fgfmd'
    selection_fault:
        msg|contains:
            - 'crash'
            - 'segfault'
            - 'signal 11'
            - 'killed'
            - 'restart'
    condition: selection_process and selection_fault
falsepositives:
    - Planned FortiManager upgrades or device re-registration that restart fgfmd
    - Firmware upgrade or reboot of the FortiGate
level: high

Known false positives:

  • Planned FortiManager upgrades or device re-registration that restart fgfmd
  • Firmware upgrades or scheduled reboots of the FortiGate

Tuning notes: Adjust the index/sourcetype to your Splunk Add-on for Fortinet FortiGate deployment. Suppress during approved change windows and correlate with inbound traffic to TCP/541 (fgfm) from non-FortiManager sources. Alert on two or more events per device per hour for higher fidelity.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • TL-2026-5491 FortiGate SAML Login from Multiple Sources for One User (CVE-2023-50176 Session Fixation) · unlock with TL Creds
  • TL-2026-5491 FortiGate Logging Disabled or Reconfigured (Defense Evasion) · unlock with TL Creds
  • TL-2026-5491 FortiGate Admin Login from Previously Unseen Source IP (Valid Account Abuse) · unlock with TL Creds
  • TL-2026-5491 FortiGate SSL-VPN Web-Mode XSS Payload in Request URL (CVE-2024-26006 / CVE-2024-33510) · unlock with TL Creds
  • TL-2026-5491 FortiGate Configuration Backup Export (CVE-2024-21754 Weak Backup Hashing) · unlock with TL Creds
  • TL-2026-5491 FortiGate Administrator or API User Added or Modified · unlock with TL Creds
  • TL-2026-5491 FortiGate Interface allowaccess Changed to Include fgfm (CVE-2024-26010 Exposure) · unlock with TL Creds
  • TL-2026-5491 FortiOS REST API Token Exposed in Logs (CVE-2024-47570) · unlock with TL Creds

Indicators of compromise for RUGGEDCOM APE1808 FortiGate flaws

As of 2026-11-07, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5491.

7 indicators of compromise · unlock with TL Creds. Compare plans

How RUGGEDCOM APE1808 FortiGate flaws works

Siemens SSA-698820 (initially published 2024-07-09, revised 11 times through V2.0 on 2026-01-13) tracks upstream Fortinet FortiOS vulnerabilities that apply to the Fortigate next-generation firewall (NGFW) application hosted on the RUGGEDCOM APE1808 industrial application-hosting platform. All RUGGEDCOM APE1808 devices running Fortigate NGFW below V7.4.4 are affected by all listed CVEs. The advisory reports a base CVSS v3.1 score of 7.5, driven by CVE-2024-26010, CVE-2024-26006 and CVE-2023-50176.

The highest-impact issues are memory-safety and session flaws. CVE-2024-26010 is a stack-based buffer overflow (CWE-121/CWE-787) reachable through crafted packets to the fgfm (FortiGate-to-FortiManager) daemon, rated CVSS 7.5 and potentially allowing unauthorized code or command execution; the vendor workaround is to remove fgfm access from interface allowaccess settings (FG-IR-24-036), at the cost of FortiManager discovery. CVE-2023-46720 is a stack-based overflow reachable through crafted CLI commands by a high-privilege local user (CVSS 6.7). CVE-2023-50176 is a session fixation flaw (CWE-384) allowing code or command execution through a phished SAML authentication link (CVSS 7.5). CVE-2024-26006 is an XSS in the SSL-VPN web interface exploitable via social engineering by an unauthenticated remote attacker (CVSS 7.5); the workaround is disabling SSL-VPN web-mode (FG-IR-23-485).

The remaining CVEs are medium or low severity but are relevant for hardening and detection: CVE-2024-23111 (reboot-page XSS, super-admin), CVE-2024-26008 and CVE-2025-47295 (fgfm daemon exception handling / buffer over-read causing connection resets or daemon crashes), CVE-2024-26011 (missing authentication for a critical function), CVE-2024-26015 (IP blocklist bypass through numbers parsed with different radices), CVE-2024-33510 (SSL-VPN injection enabling phishing), CVE-2024-36505 (file integrity check bypass for an attacker who already has write access), CVE-2024-47570 (REST API tokens of other administrators exposed in logs to a read-only administrator when non-default logging is enabled), CVE-2024-50568 (downstream device identity spoofing in the Security Fabric channel), and CVE-2024-21754 (weak password hashing in backup files, CVSS 1.8).

The Siemens advisory and the fetched upstream sources do not report active exploitation or a public PoC for these CVEs; the Fortinet advisory for CVE-2024-26010 states no known exploits are documented. CISA KEV membership was not confirmed for any of the 14 CVEs (the catalog excerpt that could be read contained none of them). Remediation is to update the Fortigate NGFW on RUGGEDCOM APE1808 to V7.4.4 (contact Siemens customer support for patch details), apply the listed workarounds where patching is delayed, restrict management and fgfm exposure, and follow Siemens' operational guidelines for industrial security. No network IOCs (C2 IPs/domains) are associated with this advisory, so no BeaconBeagle correlation was applicable.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter; T1204.001 User Execution: Malicious Link

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Credential Access

T1212 Exploitation for Credential Access; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials

Impact

T1499.004 Application or System Exploitation

defense-impairment

T1685 Disable or Modify Tools

Remediation for RUGGEDCOM APE1808 FortiGate flaws

Patches

  • Fortigate NGFW V7.4.4 (RUGGEDCOM APE1808)
  • Upstream FortiOS fixed releases include 7.0.15, 7.2.8 and 7.4.4 (CVE-2024-26010)

Immediate actions

  • Update Fortigate NGFW on RUGGEDCOM APE1808 to V7.4.4 or later and contact Siemens customer support for patch details
  • Remove fgfm from allowaccess on untrusted interfaces (FG-IR-24-036 workaround for CVE-2024-26010)
  • Disable SSL-VPN web-mode where not required (FG-IR-23-485 workaround for CVE-2024-26006)

Workarounds

  • CVE-2024-26006: disable SSL-VPN web-mode per FG-IR-23-485
  • CVE-2024-26010: remove fgfm access per FG-IR-24-036

Longer-term hardening

  • Follow Siemens operational guidelines for industrial security
  • Subscribe to the Fortinet PSIRT RSS feed and Siemens ProductCERT advisories
  • Restrict management, SSL-VPN and fgfm access to trusted networks and review administrator API token and REST API logging practices

Affected and fixed versions

  • Siemens — RUGGEDCOM APE1808 (Fortigate NGFW)
    Vulnerable versions: All versions with Fortigate NGFW < V7.4.4
    Fixed in: Fortigate NGFW V7.4.4
  • Fortinet — FortiOS
    Vulnerable versions: 6.0.x; 6.2.x; 6.4.x; 7.0.0-7.0.14; 7.2.0-7.2.7; 7.4.0-7.4.3
    Fixed in: 7.0.15; 7.2.8; 7.4.4

Timeline of RUGGEDCOM APE1808 FortiGate flaws

  • CVE-2024-26010 (fgfmd stack-based buffer overflow, CVSS 7.5) published in NVD
  • Siemens publishes SSA-698820 V1.0 covering Fortigate NGFW before V7.4.4 on locked-ioc-6
  • Siemens V1.1 updates CVE-2024-23111 and adds CVE-2024-26006 and CVE-2024-26015; NVD publishes CVE-2024-36505
  • Siemens V1.2 adds CVE-2024-36505 (file integrity check bypass)
  • Siemens V1.3 fixes version availability and adds mitigations for CVE-2024-26006 (disable SSL-VPN web-mode) and CVE-2024-26010 (remove fgfm access)
  • Siemens V1.4 adds CVE-2024-33510, CVE-2023-50176 and CVE-2024-26011
  • Siemens V1.6 removes CVE-2024-48886 and CVE-2024-50563 (added in V1.5) and references SSA-770770
  • Siemens V1.7 adds CVE-2025-47295 (FGFM daemon buffer over-read)
  • Siemens V1.8 adds CVE-2024-50568 (downstream device identity spoofing)
  • Siemens V1.9 adds CVE-2024-26008 (fgfm exception handling)
  • CVE-2024-47570 (API tokens exposed in REST API logs) published in NVD with fixes in FortiOS 7.2.8 and 7.4.4
  • Siemens V2.0 adds CVE-2024-47570, bringing the advisory to 14 CVEs

Sources cited for RUGGEDCOM APE1808 FortiGate flaws

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats