SSA-698820: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.4 on RUGGEDCOM APE1808 Devices
Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version of Fortigate NGFW for RUGGEDCOM APE1808 and recommends to update to the latest version. Siemens recommends to consult and implement the workarounds provided in Fortinet's upstream security notifications.
describes (14)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-47570US | medium6.6 | — | ||
An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all versions; FortiProxy 7.4.0 through 7.4.3, 7… | ||||
| CVE-2024-26008US | — | — | ||
An improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, FortiProxy version 7.4.0 through 7.4.3 and… | ||||
| CVE-2024-50568US | — | — | ||
A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7 and before 7.0.14 & FortiProxy version 7.4.0 throu… | ||||
| CVE-2025-47295US | low3.7 | — | ||
A buffer over-read in Fortinet FortiOS versions 7.4.0 through 7.4.3, versions 7.2.0 through 7.2.7, and versions 7.0.0 through 7.0.14 may allow a remote unauthenticated attacker to… | ||||
| CVE-2024-26006US | medium6.1 | — | ||
An improper neutralization of input during web page Generation vulnerability [CWE-79] in FortiOS version 7.4.3 and below, version 7.2.7 and below, version 7.0.13 and below and Fort… | ||||
| CVE-2024-33510US | medium4.3 | — | ||
An improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability [CWE-74] in FortiOS version 7.4.3 and below, version 7.2.8 and b… | ||||
| CVE-2024-26011US | critical9.8OT elevated | — | ||
A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.4, FortiManager 7.0.0 through 7.0.11, Fort… | ||||
| CVE-2023-50176US | high8.8 | — | ||
A session fixation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or… | ||||
| CVE-2024-36505US | medium5.5 | — | ||
An improper access control vulnerability [CWE-284] in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through 7.0.14 and 6.4.x may allow an attacker who has already succes… | ||||
| CVE-2024-26015US | medium4.7 | — | ||
An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and below, version 7.0.17 and below and FortiO… | ||||
| CVE-2024-26010US | high7.5 | — | ||
A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.14, FortiOS 6.4 all versions, FortiOS 6.… | ||||
| CVE-2024-23111US | medium4.8 | — | ||
An improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all version… | ||||
| CVE-2024-21754US | medium4.4 | Exploit | ||
A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all version… | ||||
| CVE-2023-46720US | high7.8 | — | ||
A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 and 6.4.6 through 6.4.15 and 6.2.9 through 6.2.16 and… | ||||
references
External citations — patches, advisories, analysis.
remediations (16)
- MitigationRUGGEDCOM APE1808
Disable SSL-VPN web-mode (see https://fortiguard.fortinet.com/psirt/FG-IR-23-485)
- MitigationRUGGEDCOM APE1808
For each interface, remove the fgfm access (see https://www.fortiguard.com/psirt/FG-IR-24-036)
- FixedRUGGEDCOM APE1808
Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.
- FixedRUGGEDCOM APE1808
Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.
- FixedRUGGEDCOM APE1808
Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.
- FixedRUGGEDCOM APE1808
Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.
- FixedRUGGEDCOM APE1808
Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.
- FixedRUGGEDCOM APE1808
Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.
- FixedRUGGEDCOM APE1808
Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.
- FixedRUGGEDCOM APE1808
Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.
- FixedRUGGEDCOM APE1808
Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.
- FixedRUGGEDCOM APE1808
Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.
- FixedRUGGEDCOM APE1808
Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.
- FixedRUGGEDCOM APE1808
Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.
- FixedRUGGEDCOM APE1808
Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.
- FixedRUGGEDCOM APE1808
Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan