PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-23111 Siemens CVE debrief

A stored cross-site scripting (XSS) vulnerability exists in the reboot page of FortiOS and FortiProxy, affecting Siemens RUGGEDCOM APE1808 deployments that incorporate Fortinet NGFW components. The flaw stems from improper neutralization of input during web page generation (CWE-79). A remote attacker with super-admin privileges can execute arbitrary JavaScript code by sending crafted HTTP GET requests to the affected reboot page. The vulnerability requires high privileges and user interaction, limiting its exploitability but maintaining significant impact potential given the administrative access required.

Vendor
Siemens
Product
RUGGEDCOM APE1808
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-07-09
Original CVE updated
2026-01-14
Advisory published
2024-07-09
Advisory updated
2026-01-14

Who should care

Organizations operating Siemens RUGGEDCOM APE1808 industrial networking equipment; critical infrastructure operators using Fortinet NGFW components in industrial environments; security teams responsible for administrative interface protection; OT security practitioners managing FortiOS or FortiProxy deployments

Technical summary

The vulnerability exists in the reboot page functionality of FortiOS versions 7.4.3 and below, all 7.2.x versions, all 7.0.x versions, all 6.4.x versions, and FortiProxy versions 7.4.2 and below, all 7.2.x versions, all 7.0.x versions, and all 2.0.x versions. The improper input neutralization allows JavaScript injection that executes in the context of the administrative interface. Siemens RUGGEDCOM APE1808 incorporates Fortinet NGFW technology and is affected through this component. The fix requires updating the Fortigate NGFW component to version 7.4.4, available through Siemens customer support.

Defensive priority

medium

Recommended defensive actions

  • Apply vendor-provided firmware update to Fortigate NGFW version 7.4.4 or later; contact Siemens customer support to obtain patch and update instructions for RUGGEDCOM APE1808 deployments
  • Implement principle of least privilege for administrative accounts; restrict super-admin access to essential personnel only
  • Enable multi-factor authentication for all administrative accounts to reduce risk of credential compromise
  • Monitor administrative access logs for unusual reboot page access patterns or unexpected HTTP GET requests
  • Segment management interfaces from operational networks; restrict administrative access to trusted hosts and networks
  • Review and apply CISA ICS recommended practices for defense-in-depth strategies in industrial control environments

Evidence notes

The vulnerability description indicates this is a stored XSS issue in the reboot page interface. The attack vector requires authenticated super-admin access, making this primarily a concern for compromised administrative accounts or insider threats. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) reflects network accessibility, low attack complexity, high privileges required, user interaction needed, and high impacts across confidentiality, integrity, and availability. Siemens has issued guidance through SSA-698820, with CISA coordinating public disclosure via ICSA-24-193-02. The advisory has undergone nine revisions since initial publication, with the most recent update in November 2025 adding CVE-2024-26008 to the tracked upstream vulnerabilities.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-23111 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-23111

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-23111 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-23111

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-193-02.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-698820.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-698820.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-193-02

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.