Siemens RUGGEDCOM APE1808 Vulnerable to Critical Brotli Decoder Flaw
A critical out-of-bounds write vulnerability in the Brotli decoder affects Siemens RUGGEDCOM APE1808 devices, potentially leading to code execution.
Siemens RUGGEDCOM APE1808 devices are susceptible to a critical vulnerability, CVE-2026-111497, stemming from an out-of-bounds write flaw within the Brotli decompression library. This vulnerability, identified in Brotli versions 1.0.3 through 1.2.0, poses a significant risk to industrial control systems.
The flaw resides in the Brotli decoder's handling of compressed data. When processing a crafted Brotli-compressed stream, an unauthenticated remote attacker can corrupt memory, leading to a range of severe consequences. These include the disclosure of sensitive memory contents, a denial-of-service condition that could render the device inoperable, or, in the most severe cases, the execution of arbitrary code on the affected device.
This vulnerability was reported to CISA by Siemens ProductCERT. The affected product is the Siemens RUGGEDCOM APE1808, with all versions listed as vulnerable. The Common Vulnerability Scoring System (CVSS) v3 base score for this vulnerability is a critical 9.8, underscoring the urgency of remediation.
Palo Alto Networks has provided information linking this vulnerability to the broader Node2Shell issue and has published advisories detailing workarounds. Siemens is advising its customers to consult these advisories and implement the suggested mitigations. The company also recommends updating any Brotli libraries or binaries that fall within the vulnerable version range (1.0.3 to 1.2.0) to the latest available versions, such as 1.0.10, 1.1.1, or 1.2.1.
The RUGGEDCOM APE1808 is deployed across critical infrastructure sectors, including critical manufacturing, and is found worldwide. The potential for memory corruption, information disclosure, denial of service, or arbitrary code execution on these industrial devices highlights the significant impact this vulnerability could have on operational technology environments.
Siemens emphasizes general security measures, including protecting network access to devices and configuring environments according to their operational guidelines for Industrial Security. Organizations are encouraged to follow the recommendations in product manuals and consult Siemens' dedicated industrial security resources for further guidance.
CISA echoes these recommendations, urging users to minimize network exposure for control system devices, isolate them from business networks, and use secure remote access methods like VPNs. Organizations are advised to perform thorough impact and risk assessments before implementing defensive measures and to report any suspected malicious activity to CISA.
This advisory details two distinct PHP use-after-free vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting Siemens RUGGEDCOM APE1808 devices. While the existing story focuses on a Brotli decoder flaw, these new vulnerabilities, stemming from improper PHP memory handling, allow for remote code execution with CVSS scores of 9.8 and 8.1 respectively. Siemens advises upgrading affected PAN-OS versions and consulting Palo Alto Networks for workarounds.