CISA warns of five vulnerabilities in Siemens RUGGEDCOM devices
Five vulnerabilities affecting all versions of industrial network devices risk disrupting energy, healthcare, and government services worldwide, according to a CISA advisory.
CISA issued an advisory on October 22, 2026, regarding five vulnerabilities in all versions of Siemens RUGGEDCOM APE1808 devices used in global critical infrastructure [1].
The flaws affect hardware deployed worldwide across several essential sectors, including energy and government services [1]. Because these devices support critical network functions, these vulnerabilities create a risk of unauthorized data modification and application disruption [1].
CISA warns of flaws in Siemens infrastructure
The advisory identifies five specific common vulnerabilities and exposures, listed as CVE-2026-33387, CVE-2026-33388, CVE-2026-33389, CVE-2026-33391, and CVE-2026-33920 [1]. According to CISA, all versions of the RUGGEDCOM APE1808 devices are affected [1].
The equipment has been assigned a CVSS v3 score of 7.5 [1]. These devices are used in industrial environments globally, including installations managed by the Germany-based Siemens [1].
Technical breakdown of APE1808 security flaws
The vulnerabilities include cross-site request forgery (CSRF), incorrect authorization, and a lack of administrator control over security [1]. One flaw involves the improper neutralization of special elements used in a template engine [1].
Specifically, CVE-2026-33387 is a template injection vulnerability found in the Dashboards functionality [1]. CISA reports that an authenticated user with the necessary privileges can create a dashboard containing a malicious payload [1].
Alternatively, a victim could be socially engineered into importing a malicious dashboard [1]. When the victim views or imports the dashboard, the payload executes within their browser context [1]. This allows an attacker to modify application data or disrupt the application's operation [1].
High-risk sectors exposed to system failure
The hardware is deployed in sectors where system stability is critical for public safety and economic continuity [1]. According to the CISA advisory, affected sectors include energy, healthcare, and public health [1].
The flaws also impact government services and facilities, as well as financial services [1]. Transportation systems and critical manufacturing facilities are among the other sectors using the affected Siemens hardware [1].
Detection and remediation path for users
The vulnerabilities were first published by Nozomi Networks in relation to Nozomi Guardian/CMC [1]. The subsequent CISA advisory alerts operators of the Siemens industrial products that are affected by these findings [1].
Siemens has not released a public download link for the fixes in the advisory [1]. Instead, the company recommends that affected users contact customer support to receive patch and update information [1].
What we don't know
- What are the specific technical risks and exploitation methods associated with CVE-2026-33388, CVE-2026-33389, CVE-2026-33391, and CVE-2026-33920?
- Has there been any evidence that these vulnerabilities have been exploited in active attacks?
- Which specific versions of the Nozomi Guardian/CMC software are linked to these hardware vulnerabilities?
Sources
- Siemens RUGGEDCOM APE1808 Devices — CISA advisories, Oct 22, 2026
