Multiple Vulnerabilities Discovered in Siemens RUGGEDCOM APE1808 Devices
Four critical vulnerabilities affecting Siemens RUGGEDCOM APE1808 devices, particularly when integrated with Nozomi Guardian/CMC, could allow for data manipulation, man-in-the-middle attacks, and disruption of operations.
Nozomi Networks has identified a series of significant vulnerabilities impacting Siemens RUGGEDCOM APE1808 devices, especially when these industrial devices are utilized in conjunction with Nozomi Guardian or CMC systems. The identified flaws, detailed in a recent CISA ICS Advisory, span across several critical functions and could expose industrial control systems to various cyber threats.
One of the most concerning vulnerabilities, CVE-2026-33387, is a template injection flaw within the Dashboards functionality. This vulnerability arises from improper validation of input parameters, allowing an authenticated user to craft a malicious dashboard. If another user imports or views this compromised dashboard, the embedded payload can execute within their browser context, potentially leading to the modification of application data or disruption of service availability. The CVSS score for this vulnerability is rated as MEDIUM (4.6).
CVE-2026-33388 addresses an access control vulnerability in the Credentials Manager. Insufficient privilege validation enables a remote authenticated user with limited privileges to view a subset of credentials. While the actual credential values are not directly exposed, an attacker could delete or edit existing entries. Such actions could disrupt authentication for dependent devices, and manipulating configuration entries might indirectly lead to credential compromise. This vulnerability carries a HIGH severity rating with a CVSS score of 7.4.
A critical man-in-the-middle (MITM) risk is introduced by CVE-2026-33389, stemming from improper certificate or host key validation in the Smart Polling functionality. The system establishes encrypted connections without validating the remote host's identity. An attacker positioned between the sensor and the polled device could impersonate the device during a polling session, intercepting communication, including credentials. These captured credentials could then be replayed to gain unauthorized access to the device or other systems sharing credentials, allowing for data tampering and operational disruption. This flaw is rated HIGH with a CVSS score of 7.5.
Further compounding the security concerns, CVE-2026-33391 is another access control vulnerability within the Smart Polling configuration. An authenticated user with limited privileges can bypass intended access controls and modify the Smart Polling discovery configuration. This could lead to an attacker disrupting the visibility of assets within the monitored network, hindering security monitoring and incident response efforts. This vulnerability is rated MEDIUM with a CVSS score of 5.4.
Additionally, CVE-2026-33920, a cross-site request forgery (CSRF) vulnerability in the login functionality, was also noted, though details were truncated in the provided text. This type of vulnerability can trick authenticated users into performing unintended actions.
These vulnerabilities affect all versions of the RUGGEDCOM APE1808 devices when used with Nozomi Guardian/CMC. Siemens has advised customers to contact their customer support to obtain the necessary patch and update information. The widespread deployment of Siemens RUGGEDCOM devices across critical infrastructure sectors such as manufacturing, transportation, energy, and healthcare makes these vulnerabilities a significant concern for operational security worldwide.