Siemens RUGGEDCOM APE1808 Firmware Vulnerabilities Disclosed Across Five CVEs

A new industrial control systems advisory published by CISA (ICSA-26-295-18) reveals five vulnerabilities in Siemens RUGGEDCOM APE1808 devices, which are commonly deployed in critical infrastructure environments and managed via Nozomi Guardian/CMC. The advisory was released on October 22, 2026.

The identified flaws are:
- CVE-2026-33387: A template injection vulnerability in the Dashboards functionality. An authenticated user with privileges can inject a malicious payload into a dashboard, or a victim can be socially engineered into importing a malicious dashboard. Execution occurs in the victim's browser context, potentially allowing modification of application data or disruption of availability. CVSS v3.1 base score: 3.1 (Medium).
- CVE-2026-33388: An access control vulnerability in the Credentials Manager. A remote authenticated user with limited privileges can view, delete, or edit a subset of credential entries. While full credential values are not exposed, an attacker who deletes or modifies entries can disrupt authentication for dependent devices or indirectly obtain credentials. CVSS v3.1 base score: 7.4 (High).
- CVE-2026-33389: An improper certificate/host key validation vulnerability in the Smart Polling functionality. Devices establish encrypted connections without validating the remote host's identity. A man-in-the-middle attacker can impersonate polled devices, intercept communications—including credentials—and replay them to authenticate against the device or other devices sharing the same credentials, enabling data tampering and operational disruption. CVSS v3.1 base score: 7.5 (High).
- CVE-2026-33391 and CVE-2026-33920: Listed in the advisory as affecting the same product line, though detailed descriptions were not included in the provided excerpt.

All five CVEs affect RUGGEDCOM APE1808 firmware versions designated vers:all/*, meaning all versions are impacted. The product is deployed worldwide across critical manufacturing, transportation systems, energy, healthcare and public health, financial services, and government services and facilities.

Siemens has not released a public patch for these vulnerabilities. The advisory states that users should contact customer support to receive patch and update information. Nozomi Networks, which integrated the affected firmware into its Guardian/CMC platform, also references the vulnerabilities in its own publication.

The vulnerabilities collectively pose risks ranging from privilege escalation and credential exposure to man-in-the-middle interception of encrypted management traffic. Because the devices are used to manage critical infrastructure, successful exploitation could disrupt operational technology (OT) environments.