Siemens RUGGEDCOM APE1808 Products

Act NowCVSS 8.2ICS-CERT ICSA-23-257-04Sep 12, 2023

Siemens

Attack path

Attack VectorLocal

Auth RequiredHigh

ComplexityLow

User InteractionNone needed

Summary

Insyde BIOS vulnerabilities affecting the Siemens RUGGEDCOM APE1808 product family. These vulnerabilities allow local attackers to exploit buffer overflows, integer issues, and memory access flaws to gain elevated privileges and modify device firmware. The issues include CWE-200 (information exposure), CWE-124 and CWE-120 (buffer overflows), CWE-125 (out-of-bounds read), CWE-787 (out-of-bounds write), and CWE-20 (improper input validation). Siemens recommends updating to BIOS version V1.0.212N. These vulnerabilities are not remotely exploitable and require local or physical access to the device.

What this means

What could happen

An attacker with local access to a RUGGEDCOM APE1808 device could exploit BIOS-level vulnerabilities to gain elevated privileges, read sensitive data, or modify firmware, potentially allowing them to alter network routing, packet filtering, or other critical functions in your utility network.

Who's at risk

This affects all variants of the Siemens RUGGEDCOM APE1808 family—industrial-grade network appliances used in utility networks for packet filtering, routing, and edge connectivity. Any organization running APE1808 devices as network gateways or access points in water, electric, or gas utility environments should prioritize updates.

How it could be exploited

An attacker with physical or local console access to a RUGGEDCOM APE1808 device can exploit vulnerabilities in the Insyde BIOS (firmware version below V1.0.212N) to execute arbitrary code at the BIOS level. This allows the attacker to bypass operating system security controls, modify device behavior, or persist malicious changes across reboots.

Prerequisites

Physical or local console access to the device
Device running BIOS version below V1.0.212N
Ability to interact with BIOS or boot process

Low complexity exploitationNo authentication required for local accessHigh EPSS score (88.5%)No patch available (end-of-life or discontinued products)Affects network security appliances

Exploitability

Likely to be exploited — EPSS score 89.2%

Public Proof-of-Concept (PoC) on GitHub (8 repositories)

Affected products (22)

22 with fix

ProductAffected VersionsFix Status

RUGGEDCOM APE1808 CKP CC<BIOS V1.0.212NBIOS V1.0.212N

RUGGEDCOM APE1808 ELAN<BIOS V1.0.212NBIOS V1.0.212N

RUGGEDCOM APE1808 ELAN CC<BIOS V1.0.212NBIOS V1.0.212N

RUGGEDCOM APE1808 SAM-L<BIOS V1.0.212NBIOS V1.0.212N

RUGGEDCOM APE1808 SAM-L CC<BIOS V1.0.212NBIOS V1.0.212N

Remediation & Mitigation

0/4

Do now

0/2

HARDENINGImplement physical security controls and restrict physical/console access to RUGGEDCOM APE1808 devices to authorized personnel only

HARDENINGConfigure network access controls to limit management traffic to these devices from trusted engineering workstations only

Schedule — requires maintenance window

0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate BIOS to version V1.0.212N or later on all affected RUGGEDCOM APE1808 devices

Long-term hardening

0/1

HARDENINGReview and document all personnel with physical access to device locations

CVEs (23)

View full CISA ICS-CERT advisory

↑↓ Navigate · Esc Close

API: /api/v1/advisories/2501282a-a444-4754-bb5b-058a13c62029

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.