CVE-2024-46670 Siemens CVE debrief

Who should care

Siemens RUGGEDCOM APE1808 owners, OT network administrators, security operations teams monitoring industrial/edge network appliances, and change-management teams responsible for applying vendor firmware or advisory-driven updates.

Technical summary

The advisory maps CVE-2024-46670 to Siemens RUGGEDCOM APE1808 and characterizes it as an out-of-bounds read that can be triggered remotely without authentication, resulting in memory consumption and denial of service. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a network-exploitable availability impact with no direct confidentiality or integrity impact in the source record. The source references should be read carefully because the embedded CVE description text names FortiOS/FortiSASE, while the advisory metadata names Siemens RUGGEDCOM APE1808.

Defensive priority

High. This is an unauthenticated, network-reachable availability issue, but it is not listed in CISA KEV in the supplied enrichment and there is no evidence here of active exploitation. Prioritize if the affected appliance is exposed to untrusted networks or is operationally critical.

Recommended defensive actions

• Apply the vendor mitigation referenced in the advisory for the affected product and version set as soon as maintenance windows allow.
• Verify whether any deployed Siemens RUGGEDCOM APE1808 instances match the affected advisory scope in the source CSAF record.
• Restrict exposure of management and service interfaces to trusted networks only, especially where the appliance is reachable from untrusted segments.
• Monitor for abnormal memory use, service instability, or unexpected restarts on affected devices.
• Confirm the advisory details against the Siemens ProductCERT material linked in the source before making change decisions, given the product-description mismatch in the corpus.

Evidence notes

Primary evidence comes from the CISA CSAF source item for ICSA-25-044-06, which maps CVE-2024-46670 to Siemens RUGGEDCOM APE1808 and includes the described impact, CVSS vector, and remediation reference. The record also includes Siemens ProductCERT references and the official CVE record link. The corpus contains an internal inconsistency: the embedded CVE description text refers to FortiOS/FortiSASE and Fortigate remediation, which does not align with the Siemens product metadata. This debrief follows the advisory metadata and flags the mismatch rather than resolving it with unsupported assumptions.

Official resources