PatchSiren cyber security CVE debrief

CVE-2024-13090 Siemens CVE debrief

A privilege escalation vulnerability in Siemens RUGGEDCOM APE1808 allows a local service account to elevate privileges due to excessively permissive sudo rules. The vulnerability has a CVSS 3.1 score of 7.0 (HIGH severity). An attacker who can execute arbitrary commands as the affected service account could potentially gain administrative access to the system. The vulnerability was published on August 12, 2025, and the advisory was last modified on January 14, 2026. CISA republished this advisory from Siemens ProductCERT SSA-978177. A vendor fix is available requiring upgrade to Nozomi Guardian / CMC V25.4.0, with CLI upgrade recommended over Web GUI.

Vendor: Siemens
Product: RUGGEDCOM APE1808
CVSS: HIGH 7
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-01-14
Advisory published: 2025-08-12
Advisory updated: 2026-01-14

Who should care

Organizations operating Siemens RUGGEDCOM APE1808 devices in industrial environments, particularly those in critical infrastructure sectors where privilege escalation could lead to operational disruption or safety impacts.

Technical summary

CVE-2024-13090 is a privilege escalation vulnerability in Siemens RUGGEDCOM APE1808 industrial networking equipment. The root cause is excessively permissive sudo rules configured for a local service account, which could allow an attacker with the ability to execute commands as that account to gain administrative privileges. The vulnerability requires local access (AV:L), high attack complexity (AC:H), and low privileges (PR:L), but successful exploitation yields high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The vendor has released a fix in Nozomi Guardian / CMC V25.4.0.

Defensive priority

HIGH

Recommended defensive actions

Upgrade Nozomi Guardian / CMC to V25.4.0 using CLI rather than Web GUI to avoid potential errors
Contact Siemens customer support to receive patch and update information
Review and restrict sudo privileges for all service accounts to principle of least privilege
Monitor for unauthorized privilege escalation attempts on affected systems
Apply defense-in-depth strategies for industrial control systems per CISA guidance

Evidence notes

CVE published 2025-08-12; advisory modified 2026-01-14 with CISA republication of Siemens ProductCERT SSA-978177. Remediation added in Revision 2 (2025-11-17).

Sources and references

Verified primary and authoritative sources

CVE-2024-13090 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-13090

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-13090 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-13090

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-09.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/csaf/ssa-978177.json

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/html/ssa-978177.html

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-09

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.