PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-53744 Siemens CVE debrief

CVE-2025-53744 is described in the supplied advisory record as a high-severity privilege assignment issue (CWE-266) that could let a remote authenticated attacker with high privileges escalate to super-admin by registering a device to a malicious FortiManager. The record is also internally inconsistent: the advisory metadata maps the issue to Siemens RUGGEDCOM APE1808, while the vulnerability description and remediation text reference FortiOS/FortiGate. Treat the record as actionable only after confirming which product family is actually in scope.

Vendor
Siemens
Product
RUGGEDCOM APE1808
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2025-05-13
Original CVE updated
2026-02-12
Advisory published
2025-05-13
Advisory updated
2026-02-12

Who should care

Security, operations, and patch-management teams responsible for the advisory’s mapped product environment, especially administrators who manage high-privilege access, device registration workflows, or centralized management integrations. Because the source record is inconsistent, asset owners should also verify product applicability before scheduling remediation.

Technical summary

The advisory labels CVE-2025-53744 as CWE-266 (incorrect privilege assignment) with CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2. According to the description, a remote authenticated attacker with high privileges may gain super-admin privileges by enrolling the device into a malicious FortiManager. However, the supplied source bundle mixes Siemens RUGGEDCOM APE1808 product metadata with FortiOS/FortiGate-specific vulnerability and remediation text, so the exact affected product line should be validated against the vendor advisory before assuming exposure.

Defensive priority

High. The reported impact is full administrative compromise, but the source inconsistency means verification is the first defensive step. If the issue applies to your environment, remediation should be prioritized promptly.

Recommended defensive actions

  • Confirm whether any deployed systems match the vendor advisory scope before making change decisions, because the supplied record mixes Siemens product metadata with FortiOS/FortiGate text.
  • If applicable to your environment, follow the vendor remediation guidance in the advisory and update to V7.4.9 or later using the secure update procedure stated in the source record.
  • Restrict and review who can perform high-privilege device registration and management actions, especially any trust relationship with external or centralized management systems.
  • Review logs and configuration-change records for unexpected device registration events or privilege changes.
  • Apply CISA ICS recommended practices and defense-in-depth guidance for monitoring, access control, and segmentation.

Evidence notes

Primary source is the CISA CSAF advisory ICSA-25-135-01 / CVE-2025-53744, published 2025-05-13 and updated through 2026-02-12. The revision history shows CVE-2025-53744 was added in Additional Release 3 on 2025-09-09, and the latest CISA republication occurred on 2026-02-12. The supplied record is internally inconsistent: product tree metadata identifies Siemens RUGGEDCOM APE1808, while the description and remediation text reference FortiOS Security Fabric and FortiGate. No KEV entry is present in the supplied enrichment.

Official resources

Public advisory. Initial CISA publication date: 2025-05-13. CVE-2025-53744 was added to the advisory in Additional Release 3 on 2025-09-09, and CISA republication was updated on 2026-02-12. No KEV entry is included in the supplied data.