PHP2Shell Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices
Act NowCVSS 9.8SSA-566512Oct 23, 2026
SiemensPalo Alto NetworksManufacturing
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
Palo Alto Networks PAN-OS contains PHP2Shell vulnerabilities that affect Siemens RUGGEDCOM APE1808 industrial firewall appliances. The vulnerabilities exist in PAN-OS versions 10.2, 11.1, 11.2, 12.1, and 12.2 on these devices. The issues allow unauthenticated remote code execution on affected appliances. Customers should apply security updates from Palo Alto Networks and implement workarounds as recommended in their upstream security notifications.
What this means
What could happen
An attacker could execute arbitrary code on the RUGGEDCOM APE1808 firewall appliance, allowing them to bypass security controls, intercept network traffic, or disrupt communications between your facility network and remote sites. This could halt remote monitoring, access control, or emergency response capabilities.
Who's at risk
Organizations operating Siemens RUGGEDCOM APE1808 industrial firewalls, particularly those in manufacturing, utility, and critical infrastructure sectors that rely on these devices for perimeter security, network segmentation, or remote access control.
How it could be exploited
An attacker could send a specially crafted network request to the PAN-OS web interface on the RUGGEDCOM APE1808. The PHP2Shell vulnerability allows unauthenticated code execution, giving the attacker direct control over the device without needing valid credentials or prior system access.
Prerequisites
- Network access to the PAN-OS web interface on the RUGGEDCOM APE1808 (typically port 443)
- No authentication required
remotely exploitableno authentication requiredlow complexityhigh EPSS score (11.6%)affects critical security infrastructureactively monitored by attackers
Exploitability
Likely to be exploited — EPSS score 11.6%
Public Proof-of-Concept (PoC) on GitHub (10 repositories)
Affected products (1)
ProductAffected VersionsFix Status
RUGGEDCOM APE1808 with Palo Alto Networks PAN-OS (10.2 All, 11.1 All, 11.2 All, 12.1 All, 12.2 All)All versionsFix available
Remediation & Mitigation
0/3
Do now
0/3HOTFIXContact Siemens or Palo Alto Networks support immediately to obtain and apply the latest PAN-OS firmware patch for the RUGGEDCOM APE1808
WORKAROUNDRestrict network access to the RUGGEDCOM APE1808 management interface (port 443) to trusted administrative networks only using firewall rules or network segmentation
HARDENINGDisable remote management access to the PAN-OS web interface if not required for normal operations
CVEs (2)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/4ea9a464-56b9-4789-8c17-b4baaccfb721Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.