Summary
Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products.
Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version.
Vulnerabilities 30
-
Critical 9.6
A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0…
KEV Feb 9, 2024 -
Critical 9.3
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0…
KEV Dec 13, 2022 -
Critical 9.2
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, vers…
KEV Jun 13, 2023 -
Medium 5.3
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS…
KEV Jul 27, 2026 -
Critical 9.0
RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authen…
-
Critical 9.0
A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager …
-
High 8.0
An incorrect privilege assignment vulnerability [CWE-266] in Fortinet FortiOS version 7.6.0, 7.4.0 through 7.4.4, 7.2.0…
-
High 8.0
A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.…
-
High 7.8
An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 …
-
High 7.7
A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.4 through 7.2.8 and version 7.4.0…
-
High 7.5
An Out-of-bounds Read vulnerability [CWE-125] in FortiOS version 7.6.0, version 7.4.4 and below, version 7.2.9 and belo…
-
High 7.1
A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS versi…
-
High 7.1
An allocation of resources without limits or throttling vulnerability [CWE-770] in FortiOS versions 7.4.0 through 7.4.4…
-
High 7.0
A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, version 7.…
-
Medium 6.8
A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.…
-
Medium 6.7CVE-2024-48884 EPSS 15%
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager…
-
Medium 6.7
A weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, …
-
Medium 6.5
A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7…
-
Medium 6.5
An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS…
-
Medium 6.4
An Improper Neutralization of CRLF Sequences in HTTP Headers ('http response splitting') vulnerability [CWE-113] in For…
-
Medium 6.2
An out-of-bounds read vulnerability [CWE-125] in FortiOS SSLVPN web portal versions 7.4.0 through 7.4.4, versions 7.2.0…
-
Medium 5.7
A heap-based buffer overflow in Fortinet FortiSRA 1.5.0, 1.4.0 through 1.4.2, FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3.…
-
Medium 5.2
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiRecorde…
-
Medium 4.8
An allocation of resources without limits or throttling [CWE-770] vulnerability in FortiOS versions 7.6.0, versions 7.4…
-
Medium 4.3
An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6,…
-
Medium 4.2
A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail …
-
Low 3.5
An insertion of sensitive information into sent data vulnerability [CWE-201] in FortiOS 7.6.0, 7.4.0 through 7.4.4 may …
-
Low 3.2
An Integer Overflow or Wraparound vulnerability [CWE-190] in version 7.4.4 and below, version 7.2.10 and below; FortiSA…
-
Low 3.0
A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS versi…
-
Low 3.0
An improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in FortiOS 7.6.0, 7.4.0 …
Revision history
-
#10
CISA Republication update based on Siemens ProductCERT SSA-770770 advisory
-
#11
CISA Republication update based on Siemens ProductCERT SSA-770770 advisory
-
#9
Added newly published upstream vulnerability CVE-2025-68686
-
#8
Added newly published upstream vulnerabilities CVE-2024-50571, CVE-2025-22258, CVE-2024-47569, CVE-2025-25252 and CVE-2025-58325
-
#7
Added newly published upstream vulnerability CVE-2024-52965
-
#6
Added newly published upstream vulnerabilities CVE-2025-22254 and CVE-2025-22251
-
#5
Added newly published upstream vulnerability CVE-2025-22252
-
#4
Added newly published upstream vulnerabilities CVE-2024-21762, CVE-2022-42475, CVE-2023-27997, CVE-2024-26013 and CVE-2024-50565. Moved CVE-2024-52963 to SSA-864900
-
#3
Added newly published upstream vulnerabilities CVE-2024-48886, CVE-2024-50563, CVE-2024-45324 and CVE-2024-3596
-
#2
Added newly published upstream vulnerabilities CVE-2024-35279 and CVE-2024-40591
-
#1
Publication Date
References
-
SSA-770770: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.7 on RUGGEDCOM APE1808 Devices - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-770770.html
-
ICS Advisory ICSA-25-044-06 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-06
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b