Critical 3 exploited CVEs ICSA-25-135-01 22 CVEs

Siemens RUGGEDCOM APE1808 Devices

Published May 13, 2025 · Updated Jul 9, 2026 · Revision 12

Vendor: Siemens Product: RUGGEDCOM APE1808

Summary

Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products.

Siemens is preparing fix versions and recommends to consult and implement the workarounds provided in Fortinet's upstream security notifications.

Vulnerabilities 22

Critical 9.1

CVE-2025-59718 Exploited Public exploit EPSS 68%

A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0…

Fortinet FortiOS FortiProxy FortiSwitchManager Network devices

Dec 9, 2025
KEV Dec 16, 2025
Critical 9.1

CVE-2025-59719 Exploited EPSS 27%

An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.…

Fortinet FortiWeb Network devices

Dec 9, 2025
High 7.4

CVE-2025-25249 Exploited

A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiO…

Fortinet FortiOS FortiSwitchManager Network devices

Jan 13, 2026
KEV Sep 9, 2026
High 8.3

CVE-2025-53844

A out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0…

Fortinet FortiOS Network devices

May 12, 2026
Medium 6.9

CVE-2025-53843

A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, Forti…

Fortinet FortiOS Network devices

Nov 18, 2025
Medium 6.9

CVE-2025-58413

A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, Forti…

Fortinet FortiOS FortiSASE Network devices

Nov 18, 2025
Medium 6.8

CVE-2025-25253

An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below,…

Fortinet FortiOS FortiProxy FortiPAM Network devices

Oct 14, 2025
Medium 6.8

CVE-2025-53744

An incorrect privilege assignment vulnerability [CWE-266] in FortiOS Security Fabric version 7.6.0 through 7.6.2, 7.4.0…

Fortinet FortiOS Network devices

Aug 12, 2025
Medium 6.7

CVE-2025-57740

An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, vers…

Fortinet FortiOS FortiProxy FortiPAM Network devices

Oct 14, 2025
Medium 6.3

CVE-2025-22862

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7.4.0 through 7.4.7, 7.2…

Fortinet FortiOS FortiProxy Network devices

Oct 2, 2025
Medium 6.0

CVE-2025-24471

An Improper Certificate Validation vulnerability [CWE-295] in FortiOS version 7.6.1 and below, version 7.4.7 and below …

Fortinet FortiOS Network devices

Jun 10, 2025
Medium 4.9

CVE-2024-55599

An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 a…

Fortinet FortiOS FortiProxy Network devices

Jul 8, 2025
Medium 4.8

CVE-2025-25248

An Integer Overflow or Wraparound vulnerability [CWE-190] in FortiOS version 7.6.2 and below, version 7.4.7 and below, …

Fortinet FortiOS FortiProxy FortiPAM Network devices

Aug 12, 2025
Medium 4.5

CVE-2025-31366

An Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] vulnerability in Fortinet FortiOS…

Fortinet FortiOS FortiProxy FortiSASE Network devices

Oct 14, 2025
Medium 4.4

CVE-2024-50562 Public exploit

An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, v…

Fortinet FortiOS FortiProxy FortiPAM Network devices

Jun 10, 2025
Low 3.9

CVE-2025-25250

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS…

Fortinet FortiOS FortiSASE Network devices

Jun 10, 2025
Low 3.5

CVE-2024-52963

A out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.…

Fortinet FortiOS FortiProxy FortiPAM Network devices

Jan 14, 2025
Low 2.6

CVE-2025-31514

A insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 a…

Fortinet FortiOS FortiProxy Network devices

Oct 14, 2025
Low 2.5

CVE-2025-47890

An URL Redirection to Untrusted Site vulnerabilities [CWE-601] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, F…

Fortinet FortiOS FortiProxy FortiSASE Network devices

Oct 14, 2025
Low 2.5

CVE-2025-58903

An Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API …

Fortinet FortiOS Network devices

Oct 14, 2025
Low 2.1

CVE-2024-32122

A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS …

Fortinet FortiOS Network devices

Apr 8, 2025
Low 1.7

CVE-2025-54821

An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS…

Fortinet FortiOS FortiProxy FortiPAM Network devices

Nov 18, 2025

Revision history

2026-07-09 #12
CISA Republication update based on Siemens ProductCERT SSA-864900 advisory
2026-06-09 #11
Added CVE-2025-53844. Updated remediation for CVE-2025-31514 and CVE-2025-54821
2026-02-12 #10
CISA Republication update based on Siemens ProductCERT SSA-864900 advisory
2026-02-10 #9
Added CVE-2025-25249
2026-01-22 #8
CISA Republication - Initial Republication of Siemens ProductCERT SSA-864900 advisory
2026-01-22 #7
Updated remediation for CVE-2024-52963 , CVE-2024-32122, CVE-2024-32122, CVE-2024-50562, CVE-2025-22862, CVE-2025-24471, CVE-2025-25250 , CVE-2024-55599, CVE-2025-25248, CVE-2025-53744, CVE-2025-57740, CVE-2025-58903, CVE-2025-31366, CVE-2025-47890, CVE-2025-25253, CVE-2025-58413, CVE-2025-53843, CVE-2025-59718 and CVE-2025-59719
2026-01-13 #6
Added CVE-2025-54821, CVE-2025-58413, CVE-2025-53843, CVE-2025-59718 and CVE-2025-59719
2025-11-11 #5
Added CVE-2025-57740, CVE-2025-31514, CVE-2025-58903, CVE-2025-31366, CVE-2025-47890 and CVE-2025-25253
2025-09-09 #4
Added CVE-2025-25248 and CVE-2025-53744
2025-08-12 #3
Added CVE-2024-55599
2025-07-08 #2
Added CVE-2025-24471, CVE-2025-22862, CVE-2024-50562 and CVE-2025-25250
2025-05-13 #1
Publication Date

References

SSA-864900: Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-864900.html
ICS Advisory ICSA-25-135-01 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-01
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b