CISA 2026-08-12

Siemens RUGGEDCOM APE1808

Machine-generated analysis · WAYSCloud LLM

Siemens RUGGEDCOM APE1808 devices that include a Fortinet NGFW are listed as affected by cross-site scripting (CVE-2026-23573) and path-traversal (CVE-2026-59839) vulnerabilities.

Context

The advisory identifies Siemens RUGGEDCOM APE1808 with Fortinet NGFW as the affected product. It states the devices are vulnerable to cross-site scripting (CVE-2026-23573) and path-traversal (CVE-2026-59839) issues. Siemens advises contacting customer support for detailed information and to follow the Fortinet advisory for mitigation. The advisory notes worldwide deployment across critical manufacturing, energy, and transportation sectors.

Operator considerations

Check: Verify inventory of any Siemens RUGGEDCOM APE1808 units that incorporate a Fortinet NGFW.
Isolate: If possible, place the affected units in a segmented network zone limiting exposure to untrusted traffic.
Patch: Contact Siemens customer support to obtain the recommended fix and apply any Fortinet-provided mitigation steps.
Log: Monitor web interface and proxy logs for unexpected request patterns that could indicate XSS or path-traversal attempts.

From Cybersecurity and Infrastructure Security Agency ↗

Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens recommends to contact customer support for additional information, and follow Fortinet advisory for workarounds and mitigation measures.

The following versions of Siemens RUGGEDCOM APE1808 are affected:

RUGGEDCOM APE1808 vers:all/* (CVE-2026-23573, CVE-2026-59839)

Vendor

Equipment

Siemens

Siemens RUGGEDCOM APE1808

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Critical Infrastructure Sectors: Critical Manufacturing, Energy, Transportation Systems

Countries/Areas Deployed: Worldwide

Company Headquarters Location: Germany

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-...

Read the full advisory on CISA →