PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-26006 Siemens CVE debrief

CVE-2024-26006 is a cross-site scripting (XSS) vulnerability in FortiOS and FortiProxy's web SSL VPN UI, affecting Siemens RUGGEDCOM APE1808 devices that incorporate Fortinet NGFW technology. The vulnerability, published July 9, 2024, carries a HIGH severity CVSS 7.5 score and requires user interaction through social engineering—specifically, convincing a targeted user to bookmark a malicious Samba server and subsequently open that bookmark. The attack vector is network-based with high attack complexity, requiring no privileges but user interaction, with high impacts to confidentiality, integrity, and availability. This represents an upstream vulnerability from Fortinet affecting Siemens industrial control infrastructure. Siemens released a fix in October 2024, with Fortigate NGFW version 7.4.4 addressing the issue. CISA's advisory ICSA-24-193-02 has been updated multiple times since initial publication, most recently in November 2025 to add related vulnerability CVE-2024-26008. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Siemens
Product
RUGGEDCOM APE1808
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-07-09
Original CVE updated
2026-01-14
Advisory published
2024-07-09
Advisory updated
2026-01-14

Who should care

Organizations operating Siemens RUGGEDCOM APE1808 industrial networking devices with SSL VPN web-mode enabled; OT security teams managing Fortinet-integrated industrial firewalls; security awareness trainers addressing social engineering vectors in industrial environments

Technical summary

Improper neutralization of input during web page generation (CWE-79) in FortiOS and FortiProxy web SSL VPN UI allows remote unauthenticated attackers to execute cross-site scripting attacks. Attack requires social engineering victim to bookmark malicious Samba server then open bookmark. Affects Siemens RUGGEDCOM APE1808 with integrated Fortinet NGFW. Fixed in Fortigate NGFW 7.4.4.

Defensive priority

HIGH

Recommended defensive actions

  • Apply vendor fix: Update Fortigate NGFW to version 7.4.4 by contacting Siemens customer support for patch and update information
  • Consider mitigation: Disable SSL-VPN web-mode if immediate patching is not feasible, per Fortinet PSIRT guidance
  • Review user security awareness training to address social engineering risks associated with bookmark-based attacks
  • Monitor for suspicious Samba server bookmarking activity in SSL VPN logs
  • Apply defense-in-depth controls per CISA ICS recommended practices for industrial control systems

Evidence notes

CVE description and CVSS vector from CISA CSAF source ICSA-24-193-02. Vendor attribution to Siemens for RUGGEDCOM APE1808 product. Remediation timeline from revision history showing vendor fix added October 8, 2024. CVSS 7.5 severity confirmed from source data. Not in KEV per enrichment data.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-26006 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-26006

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-26006 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-26006

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-193-02.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-698820.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-698820.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-193-02

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.