[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhhfiwJ8OZo9s-X9ubcZMv4jT64AcIbdd-u9N2LrAuqw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"956f124d-914b-47c9-9c64-93781a5c84fd","unpatched-pan-os-flaws-in-siemens-ruggedcom-devices-enable-remote-code-execution","d1e6deb3-ab2a-4df9-a690-ac10fa3585e0","Unpatched PAN-OS Flaws in Siemens RUGGEDCOM Devices Enable Remote Code Execution","Siemens RUGGEDCOM APE1808 devices running multiple versions of Palo Alto Networks PAN-OS are vulnerable to use-after-free flaws (CVE-2026-109618 and CVE-2026-109619) that can allow attackers to execute arbitrary code remotely. The root cause is the delayed identification and remediation of known vulnerabilities in a third-party software component embedded within critical infrastructure hardware. This is particularly dangerous because RUGGEDCOM devices are commonly deployed in industrial and operational technology environments where exploitation could have serious physical consequences. The incident highlights how vulnerabilities in integrated third-party components can expose critical infrastructure operators who may not monitor upstream vendor advisories closely.","**Immediate actions:**\n- Apply the PAN-OS patches recommended by Siemens and Palo Alto Networks to all affected RUGGEDCOM APE1808 devices immediately\n- Implement available workarounds from Palo Alto Networks on any device where immediate patching is not feasible\n- Identify and inventory all RUGGEDCOM APE1808 devices in the environment to assess exposure scope\n\n**Long-term improvements:**\n- Maintain a comprehensive software bill of materials (SBOM) for all network appliances to rapidly identify third-party component vulnerabilities\n- Establish a formal process to monitor security advisories from both primary hardware vendors and their upstream software suppliers\n- Implement emergency patching procedures with defined SLAs for critical vulnerabilities in operational technology environments\n\n**Detection measures:**\n- Deploy network-based intrusion detection to monitor for exploitation attempts targeting PAN-OS management interfaces\n- Enable centralized logging on all RUGGEDCOM devices and alert on anomalous traffic or unexpected process behavior\n- Conduct regular vulnerability scans against all OT\u002FICS network appliances, including embedded software versions",[12,13,14,15,16],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(e)","NIS2 Article 21(2)(d)",{"NIS2 Article 21(2)(d)":18,"NIS2 Article 21(2)(e)":19,"NIST SP 800-53 SI-2: Flaw Remediation":20,"CIS Control 7: Continuous Vulnerability Management (v8)":21,"CIS Control 2: Inventory and Control of Software Assets (v8)":22},"This point requires supply chain security measures, which would include monitoring and responding to security advisories from upstream software suppliers such as Palo Alto Networks whose component is embedded in Siemens hardware.","This point mandates vulnerability handling and disclosure practices in acquisition and maintenance, directly covering the obligation to track and remediate known CVEs in embedded third-party software components like PAN-OS.","SI-2 requires organizations to identify, report, and correct information system flaws; applying this control would have driven timely patching of the PAN-OS use-after-free vulnerabilities.","This control requires organizations to continuously assess and remediate vulnerabilities; a formal program would have surfaced the PAN-OS flaws in the RUGGEDCOM devices before exploitation was possible.","Tracking all software running on network appliances, including embedded third-party components like PAN-OS, would have enabled faster identification of which devices were affected by these CVEs.","published","2026-11-12T18:21:47.830116+00:00","2026-11-12T18:21:47.799+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-316-05","siemens-ruggedcom-ape1808-057c02","Siemens RUGGEDCOM APE1808",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[45,48,51],{"slug":34,"name":46,"problem":47},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":40,"name":49,"problem":50},"Automated patch management","Known holes get closed in days, not months.",{"slug":52,"name":53,"problem":54},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection."]