Multiple vulnerabilities in Fortigate NGFW on Siemens RUGGEDCOM APE1808 devices

1) Infinite loop

EUVDB-ID: #VU77959

Risk: Low

CVSSv3.1: 4.5 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-33305

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in firmware upgrade function. A remote privileges user can consume all available system resources and cause denial of service conditions via a specially crafted firmware image.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper Certificate Validation

EUVDB-ID: #VU77181

Risk: Medium

CVSSv3.1: 6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-29175

CWE-ID: CWE-295 - Improper Certificate Validation

Exploit availability: No

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to improper certificate validation when connecting to a remote FortiGuard's map server. A remote attacker can perform MitM attack and access or alter sensitive data.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Access of Uninitialized Pointer

EUVDB-ID: #VU77179

Risk: Low

CVSSv3.1: 4 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-29178

CWE-ID: CWE-824 - Access of Uninitialized Pointer

Exploit availability: No

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to access to an uninitialized pointer within the administrative API interface. A remote user repeatedly send crafted HTTP or HTTPS requests to the API to crash the httpsd process.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) NULL pointer dereference

EUVDB-ID: #VU77176

Risk: Medium

CVSSv3.1: 6 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-29179

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote user can send a specially crafted HTTP request to the /proxy endpoint and crash the SSL-VPN daemon.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) NULL pointer dereference

EUVDB-ID: #VU77178

Risk: Medium

CVSSv3.1: 6.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-29180

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote non-authenticated attacker can send a specially crafted HTTP request to the /proxy endpoint and crash the SSL-VPN daemon.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Format string error

EUVDB-ID: #VU77177

Risk: Medium

CVSSv3.1: 8.1 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-29181

CWE-ID: CWE-134 - Use of Externally-Controlled Format String

Exploit availability: No

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a format string error in the Fclicense daemon. A remote user can send specially crafted requests to the daemon that contains format string specifiers and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Stored cross-site scripting

EUVDB-ID: #VU80761

Risk: Medium

CVSSv3.1: 5 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-29183

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via guest management setting. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Improper access control

EUVDB-ID: #VU81970

Risk: Medium

CVSSv3.1: 5 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-33301

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the FortiOS REST API component. A remote user can bypass implemented security restrictions and gain unauthorized access to the application.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) NULL pointer dereference

EUVDB-ID: #VU77494

Risk: Medium

CVSSv3.1: 6 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-33306

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in SSL-VPN. A remote user can send a specially crafted request and perform a denial of service (DoS) attack.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Insufficient Session Expiration

EUVDB-ID: #VU78114

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-28001

CWE-ID: CWE-613 - Insufficient Session Expiration

Exploit availability: No

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to insufficient session expiration issue in FortiOS REST API, which results in a persistent websocket connection after deleting the API admin. A remote attacker can reuse the session of a deleted user and gain unauthorized access to the system.

Successful exploitation of the vulnerability requires knowledge of an API token.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) NULL pointer dereference

EUVDB-ID: #VU87581

Risk: Medium

CVSSv3.1: 6 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-33307

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in SSL-VPN. A remote user can send a specially crafted request and perform a denial of service (DoS) attack.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Reflected cross-site scripting

EUVDB-ID: #VU81968

Risk: Medium

CVSSv3.1: 5.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-36555

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data when processing data passed via the SAML and Security Fabric components. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Format string error

EUVDB-ID: #VU84439

Risk: Medium

CVSSv3.1: 6 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-36639

CWE-ID: CWE-134 - Use of Externally-Controlled Format String

Exploit availability: No

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a format string error in HTTPSd. A remote privileged user can send a specially crafted request that contains format string specifiers and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) NULL pointer dereference

EUVDB-ID: #VU83247

Risk: Medium

CVSSv3.1: 6 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-36641

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error when processing HTTP headers in SSL VPN. A remote user can send a specially crafted HTTP request to the system and perform a denial of service (DoS) attack.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Information disclosure

EUVDB-ID: #VU81969

Risk: Low

CVSSv3.1: 3.4 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-37935

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to authentication tokens are passed via HTTP GET parameters in plain text in the FortiOS SSL VPN component. A remote attacker with ability to access parameters of HTTP GET request (e.g. by accessing proxy logs) can gain access to sensitive information.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Interpretation Conflict

EUVDB-ID: #VU84443

Risk: Medium

CVSSv3.1: 6.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-40718

CWE-ID: CWE-436 - Interpretation Conflict

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security policies.

The vulnerability exists due to an interpretation conflict when handling custom TCP flags. A remote attacker can send specially crafted TCP packets to evade NGFW policies or IPS Engine protection.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Use-after-free

EUVDB-ID: #VU81928

Risk: Medium

CVSSv3.1: 6.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-41675

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the Web proxy process. A remote non-authenticated attacker can send multiple specially crafted packets to the device and perform a denial of service (DoS) attack.

Successful exploitation of the vulnerability requires that SSL deep packet inspection is enabled.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Improper Authorization

EUVDB-ID: #VU81971

Risk: Low

CVSSv3.1: 6 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-41841

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: No

The vulnerability allows a remote user to escalate privileges on the device.

The vulnerability exists due to improper authorization within the Web UI component. A remote authenticated user with the prof-admin profile can perform elevated actions on the device.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Improper validation of integrity check value

EUVDB-ID: #VU83246

Risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-28002

CWE-ID: CWE-354 - Improper Validation of Integrity Check Value

Exploit availability: No

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to improper validation of integrity check value in FortiOS and FortiProxy VMs. A local admin user can boot a malicious image on the device and bypass the filesytem integrity check in place.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Inclusion of Sensitive Information in Log Files

EUVDB-ID: #VU77183

Risk: Low

CVSSv3.1: 4 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-26207

CWE-ID: CWE-532 - Information Exposure Through Log Files

Exploit availability: No

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to software stores sensitive information into log files. A remote user can read certain SMTP passwords in plain text.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Cross-site scripting

EUVDB-ID: #VU74858

Risk: Medium

CVSSv3.1: 5.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-41330

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in administrative interface. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Buffer Underwrite ('Buffer Underflow')

EUVDB-ID: #VU73200

Risk: High

CVSSv3.1: 9.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C]

CVE-ID: CVE-2023-25610

CWE-ID: CWE-124 - Buffer Underwrite ('Buffer Underflow')

Exploit availability: Yes

The vulnerability allows a remote attacker to compromise the affected device.

The vulnerability exists due to a heap buffer underflow in the administrative interface. A remote non-authenticated attacker can send a specially crafted request to the administrative web interface of the affected device, trigger memory corruption and execute arbitrary code on the system.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

23) Heap-based buffer overflow

EUVDB-ID: #VU77175

Risk: Critical

CVSSv3.1: 10 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:U/RC:C]

CVE-ID: CVE-2023-27997

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the SSL-VPN feature. A remote non-authenticated attacker can send specially crafted requests to the SSL-VPN interface, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

24) Stack-based buffer overflow

EUVDB-ID: #VU78112

Risk: Critical

CVSSv3.1: 9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-33308

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing specially crafted packets. A remote unauthenticated attacker can send specially crafted packets to the device having proxy policies or firewall policies with proxy mode alongside SSL deep packet inspection, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Improper Certificate Validation

EUVDB-ID: #VU72344

Risk: Medium

CVSSv3.1: 4.4 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-39948

CWE-ID: CWE-295 - Improper Certificate Validation

Exploit availability: No

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to improper certificate validation when establishing secure connections with threat feed fabric connectors. A remote attacker can perform MitM attack on the communication channel between the affected device and remote servers hosting threat feeds.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Cleartext transmission of sensitive information

EUVDB-ID: #VU77960

Risk: Low

CVSSv3.1: 7.1 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-41327

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software uses insecure communication channel to transmit sensitive information. A local user with readonly superadmin privileges can intercept traffic in order to obtain other adminstrators cookies via diagnose CLI commands.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Path traversal

EUVDB-ID: #VU73199

Risk: High

CVSSv3.1: 6 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N/E:H/RL:U/RC:C]

CVE-ID: CVE-2022-41328

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

The vulnerability allows a local user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing certain CLI command. A local user can read and write arbitrary files on the system.

Note, the vulnerability is being actively exploited in the wild.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

28) Improper access control

EUVDB-ID: #VU73208

Risk: Medium

CVSSv3.1: 4.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-41329

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

The vulnerability allows a remote attacker to gain unauthorized access to sensitive information.

The vulnerability exists due to improper access restrictions. A remote attacker can send a specially crafted HTTP request and obtain sensitive logging information on the device.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Cross-site scripting

EUVDB-ID: #VU72350

Risk: Medium

CVSSv3.1: 5.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-41334

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via the "redir" parameter of the Login page when the "Sign in with FortiCloud" button is clicked. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Open redirect

EUVDB-ID: #VU74852

Risk: Low

CVSSv3.1: 3.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-22641

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Exploit availability: No

The vulnerability allows a remote attacker to redirect victims to arbitrary URL.

The vulnerability exists due to improper sanitization of user-supplied data in sslvpnd. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain.

Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU74859

Risk: Medium

CVSSv3.1: 5 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-42469

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote user to bypass implemented policy.

The vulnerability exists due to improperly imposed permissions in FortiGate Policy-based NGFW Mode. A remote SSL-VPN user can bypass the policy via bookmarks in the web portal.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Path traversal

EUVDB-ID: #VU77961

Risk: Low

CVSSv3.1: 2.5 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-42474

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

The vulnerability allows a remote user to delete arbitrary directories on the system.

The vulnerability exists due to input validation error when processing directory traversal sequences within the administrative interface. A remote user can send a specially crafted HTTP request and delete arbitrary directories from the filesystem.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Path traversal

EUVDB-ID: #VU73207

Risk: Low

CVSSv3.1: 5.5 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-42476

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to input validation error when processing directory traversal sequences. A local privileged VDOM administrator can escalate their privileges to super admin of the box via crafted CLI requests.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Improper Restriction of Excessive Authentication Attempts

EUVDB-ID: #VU74856

Risk: Medium

CVSSv3.1: 6.9 [CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-43947

CWE-ID: CWE-307 - Improper Restriction of Excessive Authentication Attempts

Exploit availability: No

The vulnerability allows a remote attacker to perform a brute-force attack.

The vulnerability exist due to improper restriction of excessive authentication attempts in administrative interface. A remote attacker with access to the administrative interface can perform a brute-force attack and gain unauthorized access to the system.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Format string error

EUVDB-ID: #VU77182

Risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-43953

CWE-ID: CWE-134 - Use of Externally-Controlled Format String

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the device.

The vulnerability exists due to a format string error in fortiguard-resources CLI command. A local user can pass specially crafted argument to the affected CLI command and execute arbitrary code on the target system.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) NULL pointer dereference

EUVDB-ID: #VU73201

Risk: Medium

CVSSv3.1: 6 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-45861

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the SSL-VPN portal. A remote authenticated user can send a specially crafted HTTP GET request and perform a denial of service (DoS) attack.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Out-of-bounds write

EUVDB-ID: #VU77180

Risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-22639

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the device.

The vulnerability exists due to a boundary error within CLI. A local user can pass specially crafted arguments to the affected command to trigger an out-of-bounds write and execute arbitrary code on the target system.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Out-of-bounds write

EUVDB-ID: #VU75734

Risk: High

CVSSv3.1: 8.1 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-22640

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a boundary error in sslvpnd. A remote authenticated user can send a specially crafted request to trigger an out-of-bounds write and execute arbitrary code on the target system.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

RUGGEDCOM APE1808: All versions

http://cert-portal.siemens.com/productcert/txt/ssa-366067.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.