OTPulse
FeedAboutContact

Vulnerability in Nozomi Guardian/CMC Before 25.4.0 on RUGGEDCOM APE1808 Devices

Plan Patch8.1SSA-978177Aug 12, 2025
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

Nozomi Guardian/CMC contains multiple vulnerabilities affecting RUGGEDCOM APE1808 devices. These include authorization bypass (CWE-863), OS command injection (CWE-78), path traversal (CWE-22), SQL injection (CWE-89), cross-site scripting (CWE-79), and improper privilege management (CWE-250). An authenticated attacker could exploit these flaws to execute arbitrary commands or modify device configuration.

What this means
What could happen
An authenticated attacker could execute arbitrary commands on the RUGGEDCOM APE1808 device, potentially disrupting industrial communication protocols or stopping network monitoring functions critical to plant operations.
Who's at risk
Manufacturing facilities and utilities using RUGGEDCOM APE1808 industrial networking devices managed by Nozomi Guardian/CMC should assess this risk. APE1808 devices are commonly deployed as managed Ethernet switches or gateway devices in critical infrastructure networks (water, electric, oil/gas) for protocol monitoring, packet capture, and industrial traffic inspection.
How it could be exploited
An attacker with valid login credentials on the Nozomi Guardian/CMC management interface could submit malicious input that bypasses authorization checks and command injection filters, allowing execution of arbitrary OS-level commands on the APE1808 device.
Prerequisites
  • Valid login credentials to Nozomi Guardian/CMC web interface or CLI
  • Network access to the management interface (port and protocol depend on deployment)
  • APE1808 must be running a version before 25.4.0
Requires valid authenticationAllows arbitrary command executionHigh CVSS score (8.1)Affects critical network infrastructure deviceAuthorization bypass and command injection flaws
Exploitability
Low exploit probability (EPSS 0.2%)
Affected products (1)
ProductAffected VersionsFix Status
RUGGEDCOM APE1808All versions25.4.0
Remediation & Mitigation
0/4
Do now
0/2
WORKAROUNDRestrict network access to the Nozomi Guardian/CMC management interface to authorized engineering workstations and administrative staff only
HARDENINGRequire strong, unique passwords for all management accounts on the APE1808 and associated Guardian/CMC systems
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HOTFIXUpgrade RUGGEDCOM APE1808 to Nozomi Guardian/CMC version 25.4.0 or later
HOTFIXUse CLI instead of Web GUI for the upgrade to avoid errors during patching
View full Siemens ProductCERT advisory
↑↓ Navigate · Esc Close
API: /api/v1/advisories/09d78681-f0f7-41c5-bf03-a6e7bb1fa395