# Siemens SSA-698820: Multiple Fortigate NGFW Vulnerabilities (before V7.4.4) on RUGGEDCOM APE1808 Devices

> Siemens ProductCERT advisory SSA-698820 aggregates 14 Fortinet FortiOS vulnerabilities (stack-based buffer overflows, session fixation, XSS, missing authentication, fgfm daemon flaws and log-file information disclosure) affecting the Fortigate NGFW running on RUGGEDCOM APE1808 devices in all versions prior to V7.4.4. Siemens recommends updating Fortigate NGFW to V7.4.4.

- **Published:** 2026-11-07T06:56:11Z
- **Last reviewed:** 2026-11-07T06:56:11Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5491
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5491.png
- **ID:** TL-2026-5491
- **Severity:** HIGH (CVSS 7.5)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 7
- **CVEs:** CVE-2024-21754, CVE-2023-46720, CVE-2024-23111, CVE-2024-26010, CVE-2024-26006, CVE-2024-26015, CVE-2024-36505, CVE-2024-33510, CVE-2023-50176, CVE-2024-26011, CVE-2025-47295, CVE-2024-50568, CVE-2024-26008, CVE-2024-47570

## Description

Siemens SSA-698820 (initially published 2024-07-09, revised 11 times through V2.0 on 2026-01-13) tracks upstream Fortinet FortiOS vulnerabilities that apply to the Fortigate next-generation firewall (NGFW) application hosted on the RUGGEDCOM APE1808 industrial application-hosting platform. All RUGGEDCOM APE1808 devices running Fortigate NGFW below V7.4.4 are affected by all listed CVEs. The advisory reports a base CVSS v3.1 score of 7.5, driven by CVE-2024-26010, CVE-2024-26006 and CVE-2023-50176.

The highest-impact issues are memory-safety and session flaws. CVE-2024-26010 is a stack-based buffer overflow (CWE-121/CWE-787) reachable through crafted packets to the fgfm (FortiGate-to-FortiManager) daemon, rated CVSS 7.5 and potentially allowing unauthorized code or command execution; the vendor workaround is to remove fgfm access from interface allowaccess settings (FG-IR-24-036), at the cost of FortiManager discovery. CVE-2023-46720 is a stack-based overflow reachable through crafted CLI commands by a high-privilege local user (CVSS 6.7). CVE-2023-50176 is a session fixation flaw (CWE-384) allowing code or command execution through a phished SAML authentication link (CVSS 7.5). CVE-2024-26006 is an XSS in the SSL-VPN web interface exploitable via social engineering by an unauthenticated remote attacker (CVSS 7.5); the workaround is disabling SSL-VPN web-mode (FG-IR-23-485).

The remaining CVEs are medium or low severity but are relevant for hardening and detection: CVE-2024-23111 (reboot-page XSS, super-admin), CVE-2024-26008 and CVE-2025-47295 (fgfm daemon exception handling / buffer over-read causing connection resets or daemon crashes), CVE-2024-26011 (missing authentication for a critical function), CVE-2024-26015 (IP blocklist bypass through numbers parsed with different radices), CVE-2024-33510 (SSL-VPN injection enabling phishing), CVE-2024-36505 (file integrity check bypass for an attacker who already has write access), CVE-2024-47570 (REST API tokens of other administrators exposed in logs to a read-only administrator when non-default logging is enabled), CVE-2024-50568 (downstream device identity spoofing in the Security Fabric channel), and CVE-2024-21754 (weak password hashing in backup files, CVSS 1.8).

The Siemens advisory and the fetched upstream sources do not report active exploitation or a public PoC for these CVEs; the Fortinet advisory for CVE-2024-26010 states no known exploits are documented. CISA KEV membership was not confirmed for any of the 14 CVEs (the catalog excerpt that could be read contained none of them). Remediation is to update the Fortigate NGFW on RUGGEDCOM APE1808 to V7.4.4 (contact Siemens customer support for patch details), apply the listed workarounds where patching is delayed, restrict management and fgfm exposure, and follow Siemens' operational guidelines for industrial security. No network IOCs (C2 IPs/domains) are associated with this advisory, so no BeaconBeagle correlation was applicable.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1204.001 User Execution: Malicious Link
- T1685 Disable or Modify Tools
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1212 Exploitation for Credential Access
- T1499.004 Application or System Exploitation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5491 FortiGate fgfmd Crash or Restart (CVE-2024-26010 / CVE-2025-47295 Exploitation Attempt)** (`TL-2026-5491-SPL-001`)

Detects FortiGate (Fortigate NGFW on RUGGEDCOM APE1808, SSA-698820) event logs showing the fgfmd FortiGate-to-FortiManager daemon crashing, faulting or restarting. CVE-2024-26010 (stack-based buffer overflow), CVE-2024-26008 and CVE-2025-47295 (exception handling / buffer over-read) are all reached via crafted fgfm packets, so unexpected fgfmd crashes are the primary hunting signal for exploitation or fuzzing of the fgfm management channel.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1499.004, T1212
- **Data sources:** fortinet:fgt_event, fortigate_event_logs, CommonSecurityLog
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=fortinet sourcetype="fgt_event" subtype=system (msg="*fgfmd*" OR logdesc="*fgfm*") (msg="*crash*" OR msg="*segfault*" OR msg="*signal 11*" OR msg="*killed*" OR msg="*restart*") | stats count min(_time) as first_seen max(_time) as last_seen values(msg) as messages by host devname | eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S") | table host devname count first_seen last_seen messages
```

### Microsoft KQL

```kql
CommonSecurityLog | where TimeGenerated > ago(24h) | where DeviceVendor =~ "Fortinet" | where Message has "fgfmd" or Activity has "fgfmd" or AdditionalExtensions has "fgfmd" | where Message has_any ("crash", "segfault", "signal 11", "killed", "restart") | summarize Events = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Messages = make_set(Message, 10) by DeviceName | project DeviceName, Events, FirstSeen, LastSeen, Messages
```

### Sigma

```yaml
title: FortiGate fgfmd Daemon Crash or Restart (CVE-2024-26010)
id: 3b0f6a52-8c1e-4d7a-9a61-5e2f4c7d1a01
status: experimental
description: Detects fgfmd (FortiGate-to-FortiManager daemon) crashes or restarts on FortiGate NGFW, a signal of attempted exploitation of CVE-2024-26010, CVE-2024-26008 or CVE-2025-47295 via crafted fgfm packets (Siemens SSA-698820).
references:
    - https://cert-portal.siemens.com/productcert/html/ssa-698820.html
    - https://fortiguard.fortinet.com/psirt/FG-IR-24-036
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/07
tags:
    - attack.initial-access
    - attack.t1190
    - attack.impact
    - attack.t1499.004
    - attack.credential-access
    - attack.t1212
    - cve.2024-26010
    - cve.2024-26008
    - cve.2025-47295
logsource:
    product: fortigate
    service: event
detection:
    selection_process:
        msg|contains: 'fgfmd'
    selection_fault:
        msg|contains:
            - 'crash'
            - 'segfault'
            - 'signal 11'
            - 'killed'
            - 'restart'
    condition: selection_process and selection_fault
falsepositives:
    - Planned FortiManager upgrades or device re-registration that restart fgfmd
    - Firmware upgrade or reboot of the FortiGate
level: high
```

**Known false positives:**

- Planned FortiManager upgrades or device re-registration that restart fgfmd
- Firmware upgrades or scheduled reboots of the FortiGate

**Tuning notes:** Adjust the index/sourcetype to your Splunk Add-on for Fortinet FortiGate deployment. Suppress during approved change windows and correlate with inbound traffic to TCP/541 (fgfm) from non-FortiManager sources. Alert on two or more events per device per hour for higher fidelity.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5491 FortiGate SAML Login from Multiple Sources for One User (CVE-2023-50176 Session Fixation) (locked: unlock with TL Creds)
- TL-2026-5491 FortiGate Logging Disabled or Reconfigured (Defense Evasion) (locked: unlock with TL Creds)
- TL-2026-5491 FortiGate Admin Login from Previously Unseen Source IP (Valid Account Abuse) (locked: unlock with TL Creds)
- TL-2026-5491 FortiGate SSL-VPN Web-Mode XSS Payload in Request URL (CVE-2024-26006 / CVE-2024-33510) (locked: unlock with TL Creds)
- TL-2026-5491 FortiGate Configuration Backup Export (CVE-2024-21754 Weak Backup Hashing) (locked: unlock with TL Creds)
- TL-2026-5491 FortiGate Administrator or API User Added or Modified (locked: unlock with TL Creds)
- TL-2026-5491 FortiGate Interface allowaccess Changed to Include fgfm (CVE-2024-26010 Exposure) (locked: unlock with TL Creds)
- TL-2026-5491 FortiOS REST API Token Exposed in Logs (CVE-2024-47570) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Siemens SSA-698820: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.4 on RUGGEDCOM APE1808 Devices](https://cert-portal.siemens.com/productcert/html/ssa-698820.html)
- [NVD CVE-2024-26010](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-26010)
- [Fortinet PSIRT FG-IR-24-036 (CVE-2024-26010 fgfmd stack overflow)](https://fortiguard.fortinet.com/psirt/FG-IR-24-036)
- [NVD CVE-2024-36505](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-36505)
- [Fortinet PSIRT FG-IR-24-012 (CVE-2024-36505 file integrity bypass)](https://fortiguard.fortinet.com/psirt/FG-IR-24-012)
- [NVD CVE-2024-47570](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-47570)
- [Fortinet PSIRT FG-IR-24-268 (CVE-2024-47570 REST API log token exposure)](https://fortiguard.fortinet.com/psirt/FG-IR-24-268)
- [Fortinet PSIRT advisories index](https://www.fortiguard.com/psirt)
- [GCVE record for SSA-698820](https://db.gcve.eu/vuln/ssa-698820)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5491