Summary
Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products.
Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
Vulnerabilities 30
-
Critical 9.8
A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0…
KEV Oct 9, 2024 -
High 7.5
HTTP/2 Stream Cancellation Attack
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
KEV Oct 10, 2023 -
Critical 9.3CVE-2023-42789 Public exploit
A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0…
-
High 8.8
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the h…
-
High 8.3
An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 a…
-
High 7.7
A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, Forti…
-
High 7.5
A insufficiently protected credentials vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2…
-
High 7.4
A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.1…
-
High 7.2
An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2…
-
Medium 6.8
A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.1 through 7.2.6 and version 7.4.0…
-
Medium 6.7
An improper authentication vulnerability [CWE-287] in FortiOS versions 7.4.1 and below, versions 7.2.6 and below, and v…
-
Medium 6.5
A double free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 6.4 all versions may allow a privileged attacke…
-
Medium 6.4
A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all vers…
-
Medium 6.4
A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all vers…
-
Medium 6.3
A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged atta…
-
Medium 6.3
A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through…
-
Medium 6.2
A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, Fort…
-
Medium 6.2
A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, Fort…
-
Medium 6.1
A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.1 and below, version 7.2.7 …
-
Medium 5.9
A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2, FortiAnalyzer 7.2.0 through 7.2.5,…
-
Medium 5.2
A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager…
-
Medium 5.0
An exposure of sensitive information to an unauthorized actor in Fortinet FortiOS at least version at least 7.4.0 throu…
-
Medium 5.0
An improper check or handling of exceptional conditions vulnerability [CWE-703] in Fortinet FortiOS version 7.4.1 allow…
-
Medium 4.7
An insufficient verification of data authenticity vulnerability [CWE-345] in Fortinet FortiOS SSL-VPN tunnel mode versi…
-
Medium 4.7
An origin validation error [CWE-346] vulnerability in Fortinet FortiOS IPSec VPN version 7.4.0 through 7.4.1 and versio…
-
Medium 4.4
An improper certificate validation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, …
-
Medium 4.2
An improper authorization vulnerability [CWE-285] vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 …
-
Medium 4.1
A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison w…
-
Low 3.5
An insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, …
-
Unscored —
This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of …
Revision history
-
#13
Initial Republication of Siemens ProductCERT SSA-832273 advisory
-
#12
Added CVE-2024-40593
-
#11
Added CVE-2025-54822 and CVE-2023-46718
-
#10
Moved CVE-2024-21762 to SSA-770770
-
#9
Updated remediation for CVE-2024-21762 due to insufficient fix from Fortinet
-
#8
Added newly published upstream vulnerability CVE-2023-40721
-
#7
Added newly published upstream vulnerabilities CVE-2022-23439, CVE-2023-42785, CVE-2023-42786 and CVE-2023-46715
-
#6
Added newly published upstream vulnerability CVE-2022-45862
-
#5
Added newly published upstream CVE CVE-2024-23110
-
#4
Added newly published upstream CVEs CVE-2023-45586, CVE-2024-26007, CVE-2023-36640, CVE-2023-45583, CVE-2023-44247, CVE-2023-46714
-
#3
Added CVE-2024-23662, CVE-2023-48784, CVE-2023-41677. Adapted title to reflect latest Siemens validated release version of Fortinet NGFW
-
#2
Added CVE-2023-42789, CVE-2023-42790, CVE-2023-46717, CVE-2024-23112 and updated remediations
-
#1
Publication Date
References
-
SSA-832273: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.3 on RUGGEDCOM APE1808 Devices - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-832273.html
-
ICS Advisory ICSA-24-074-05 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-05
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b