Threat video1:00
RUGGEDCOM APE1808 FortiGate Flaws: Detection & IOCs
Siemens' SSA-698820 fixes 14 FortiGate flaws in RUGGEDCOM APE1808 devices before V7.4.4, with 7 IOCs, 9 detection rules and a free Splunk SPL rule.
Read the full threat intel for RUGGEDCOM APE1808 FortiGate Flaws: Detection & IOCs →
Chapters
- 0:00The hook14 Fortinet flaws hit industrial firewalls.
- 0:04The storyAll RUGGEDCOM APE1808 devices vulnerable.
- 0:13Attack pathBuffer overflow through crafted packets enable code execution.
- 0:28AttributionNo threat actor is attributed.
- 0:33Indicators of compromise3 indicators to hunt: 3 package names.
- 0:38MITRE ATT&CK techniques10 ATT&CK techniques, from initial access to impact.
- 0:43Remediation3 steps now: Update Fortigate NGFW on RUGGEDCOM APE1808.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0014 Fortinet flaws hit industrial firewalls.
0:05All RUGGEDCOM APE1808 devices vulnerable.
0:10Patch to version 7.4.4.
0:13Buffer overflow through crafted packets enable code execution.
0:17API tokens exposed in REST API logs allow admin takeover.
0:23Daemon crashes and resets disable network protection.
0:29No threat actor is attributed. Confidence: low.
0:333 indicators to hunt: 3 package names.
0:3910 ATT&CK techniques, from initial access to impact.
0:433 steps now: Update Fortigate NGFW on RUGGEDCOM APE1808.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.