[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fP1BHElRhC0xLkY75-PC4pxlQ06glYMPMV-zKDFnqhYI":3},{"article":4,"iocs":47,"watch_terms":52,"solutions":53,"lesson":12},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":34},"19f08848-de0b-483c-97be-496a2e966394","Siemens RUGGEDCOM APE1808","siemens-ruggedcom-ape1808-652c8f","View CSAF Summary Palo Alto Networks has published information on a vulnerability in PAN-OS related to the Node2Shell vulnerability. This advisory lists the related Siemens Industrial products affected by this vulnerability. Customers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications. The following versions of Siemens RUGGEDCOM APE1808 are affected: RUGGEDCOM APE1808 vers:all\u002F* (CVE-2026-111497) CVSS Vendor Equipment v3 9.8 Siemens RUGGEDCOM APE1808 1 Vulnerability Out-of-bounds Write Background Critical Infrastructure Sectors: Critical Manufacturing Countries\u002FAreas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c\u002Fdec\u002Fdecode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. Read More 1 Affected Product RUGGEDCOM APE1808 with Palo Alto Networks PAN-OS Product Status: known_affected Remediations Vendor fix Upgrade to corresponding available PAN-OS version. Contact customer support to receive additional patch and update information. Additional Metrics Relevant CWE: CWE-787 Out-of-bounds Write CVSS Version Base Score Base Severity Vector String 3.1 9.8 CRITICAL CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H View CVE Details Acknowledgments Siemens ProductCERT reported this vulnerability to CISA. General Recommendations As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens' operational guidelines for Industrial Security (https:\u002F\u002Fwww.siemens.com\u002Fcert\u002Foperational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https:\u002F\u002Fwww.siemens.com\u002Findustrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https:\u002F\u002Fwww.siemens.com\u002Fcert\u002Fadvisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https:\u002F\u002Fwww.siemens.com\u002Fproductcert\u002Fterms-of-use. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and\u002For systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov\u002Fics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov\u002Fics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-898633 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-30 Date Revision Summary 2026-10-30 1 Publication Date 2026-11-12 2 Initial CISA Republication of Siemens ProductCERT SSA-898633 advisory Legal Notice and Terms of Use","A critical out-of-bounds write vulnerability (CVE-2026-111497) has been identified in Siemens RUGGEDCOM APE1808 devices. The vulnerability stems from a buffer overflow in the Brotli decoder, affecting versions 1.0.3 through 1.2.0. This could allow remote attackers to corrupt memory, disclose information, cause a denial of service, or execute arbitrary code. Siemens advises users to update Brotli libraries to the latest versions and consult Palo Alto Networks' advisories for workarounds and vendor fixes.","Siemens RUGGEDCOM APE1808 affected by critical Brotli decoder vulnerability CVE-2026-111497.","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-316-04",null,"2026-11-12T12:00:00+00:00","2026-11-12T18:00:31.8923+00:00",8,[17,20,23,25,27],{"name":18,"type":19},"RUGGEDCOM APE1808","product",{"name":21,"type":22},"Siemens","vendor",{"name":24,"type":19},"PAN-OS",{"name":26,"type":22},"Palo Alto Networks",{"name":28,"type":29},"Brotli","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":12,"name":32,"slug":33},"Vulnerabilities","vulnerabilities",[35,37,42],{"category":36},{"id":30,"icon":12,"name":32,"slug":33},{"category":38},{"id":39,"icon":12,"name":40,"slug":41},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":43},{"id":44,"icon":12,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48],{"type":49,"value":50,"context":51},"cve","CVE-2026-111497","Vulnerability in Siemens RUGGEDCOM APE1808",[26,21,18],{"controls":54,"vendors":135},[55,84,109],{"slug":56,"name":57,"problem":58,"products":59},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":85,"name":86,"problem":87,"products":88},"patch-management","Automated patch management","Known holes get closed in days, not months.",[89,97,101],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":85,"product_name":98,"url":99,"description":100},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":110,"name":111,"problem":112,"products":113},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"claroty","Claroty","\u002Fvendor-logos\u002Fclaroty.png","xdome","Claroty xDome","https:\u002F\u002Fclaroty.com\u002Findustrial-cybersecurity\u002Fxdome","Asset inventory, vulnerability management and threat detection for industrial networks.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"nozomi-networks","Nozomi Networks","\u002Fvendor-logos\u002Fnozomi-networks.png","guardian","Nozomi Networks Guardian","https:\u002F\u002Fwww.nozominetworks.com\u002Fplatform\u002Fguardian","Passive monitoring, asset inventory and threat detection for OT and IoT networks.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":131,"product_name":132,"url":133,"description":134},"tenable-ot-security","Tenable OT Security","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fot-security","Asset inventory, vulnerability and threat detection for industrial networks.",[136],{"slug":137,"name":21,"logo_path":138,"roles":139},"siemens","\u002Fvendor-logos\u002Fsiemens.png",[140],"affected"]