PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-37454 Siemens CVE debrief

CVE-2022-37454 is a critical vulnerability in the Keccak XKCP SHA-3 reference implementation, affecting Siemens RUGGEDCOM APE1808 devices. The flaw involves an integer overflow in the sponge function interface that leads to a buffer overflow, potentially allowing attackers to execute arbitrary code or compromise cryptographic integrity. The vulnerability was published on April 9, 2024, with the advisory last modified on May 13, 2025. Siemens has provided a vendor fix requiring upgrade to Palo Alto Networks Virtual NGFW V11.1.2-h3, with customers directed to contact support for patch details. The CVSS 3.1 score of 9.8 reflects network exploitable, low complexity attack vectors with no privileges or user interaction required, and high impacts across confidentiality, integrity, and availability.

Vendor
Siemens
Product
RUGGEDCOM APE1808
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2023-12-12
Original CVE updated
2025-08-12
Advisory published
2023-12-12
Advisory updated
2025-08-12

Who should care

Organizations operating Siemens RUGGEDCOM APE1808 devices in industrial control system environments, particularly those with network-exposed cryptographic operations. Security teams responsible for OT/ICS infrastructure, cryptographic library maintainers, and compliance officers tracking critical infrastructure vulnerabilities should prioritize assessment and remediation. The critical CVSS score and potential for arbitrary code execution warrant immediate attention for affected deployments.

Technical summary

The vulnerability exists in the Keccak XKCP SHA-3 reference implementation prior to commit fdc6fef. The sponge function interface contains an integer overflow condition that propagates to a buffer overflow. This implementation flaw can be exploited to achieve arbitrary code execution or to degrade cryptographic assurances. The attack surface is exposed network-accessible without authentication requirements. The vulnerability affects Siemens RUGGEDCOM APE1808 when configured with Palo Alto Networks Virtual NGFW, with remediation requiring upgrade to version V11.1.2-h3.

Defensive priority

critical

Recommended defensive actions

  • Contact Siemens customer support to obtain patch and update information for Palo Alto Networks Virtual NGFW V11.1.2-h3
  • Upgrade affected RUGGEDCOM APE1808 devices to the specified fixed version
  • Review network segmentation for affected industrial control systems
  • Apply defense-in-depth strategies per CISA ICS recommended practices
  • Monitor for anomalous cryptographic behavior or unexpected code execution on affected devices

Evidence notes

The vulnerability description and affected product information are derived from CISA CSAF advisory ICSA-24-102-04, with vendor confirmation from Siemens product security documentation. The remediation guidance specifies Palo Alto Networks Virtual NGFW V11.1.2-h3 as the fixed version for RUGGEDCOM APE1808 deployments.

Sources and references

Verified primary and authoritative sources

  • CVE-2022-37454 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2022-37454

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2022-37454 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2022-37454

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-102-04.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-455250.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-455250.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-102-04

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.