Siemens RUGGEDCOM APE1808 Devices: 5 CVEs, High 7.5
Summary
CISA reports 5 vulnerabilities in Siemens RUGGEDCOM APE1808. Weakness types: Improper Neutralization of Special Elements Used in a Template Engine, Incorrect Authorization, Lack of Administrator Control over Security (+1 more). Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens recommends to contact customer support to receive patch and update information. Highest CVSS v3 score: 7.5 (High), exploitable over the network.
At a glance
- Vendor
- Siemens
- Products
- RUGGEDCOM APE1808
- CVEs
- CVE-2026-33387, CVE-2026-33388, CVE-2026-33389, CVE-2026-33391, CVE-2026-33920
- Highest CVSS v3
- 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-33387 | Improper Neutralization of Special Elements Used in a Template Engine | 4.6 | – | No | CVE-2026-33387 |
| CVE-2026-33388 | Incorrect Authorization | 7.4 | – | No | CVE-2026-33388 |
| CVE-2026-33389 | Lack of Administrator Control over Security | 7.5 | – | No | CVE-2026-33389 |
| CVE-2026-33391 | Incorrect Authorization | 5.4 | – | No | CVE-2026-33391 |
| CVE-2026-33920 | Cross-Site Request Forgery (CSRF) | 3.5 | – | No | CVE-2026-33920 |
Affected products (1)
- RUGGEDCOM APE1808 with Nozomi Guardian/CMC
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Contact customer support to receive patch and update information
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-295-18
- Machine-readable CSAF record
- https://cert-portal.siemens.com/productcert/csaf/ssa-911336.json
- https://cert-portal.siemens.com/productcert/html/ssa-911336.html
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.