Siemens RUGGEDCOM APE1808 XSS via Palo Alto GlobalProtect
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Reflected XSS in Palo Alto GlobalProtect portal enables credential theft for authenticated users clicking malicious links.
A reflected cross-site scripting vulnerability in Palo Alto Networks GlobalProtect gateway and portal features affects Siemens RUGGEDCOM APE1808 devices running PAN-OS software with GlobalProtect enabled. When an authenticated Captive Portal user clicks a specially crafted link, an attacker can execute arbitrary JavaScript in their browser context, enabling phishing attacks and credential theft—particularly if Clientless VPN is enabled. The vulnerability requires user interaction and network access but has low attack complexity. CVSS v3 score is 4.3 and CVSS v4 is 5.1. No known public exploitation has been reported to CISA as of the advisory date.
The affected equipment is deployed worldwide in critical manufacturing sectors. Siemens recommends disabling Clientless VPN as an immediate workaround and contacting customer support for patching. Defenders should minimize network exposure, isolate control system networks behind firewalls, restrict internet accessibility, and implement general phishing awareness and email filtering to defend against social engineering exploitation of this vector.
Mentioned in this report
Detection guidance
XSS Payload in Request to GlobalProtect Portal or Gateway URL (Proxy)
Detects proxy-logged requests to GlobalProtect or SSL-VPN paths whose URL carries script tags, javascript: URIs or inline event handlers, matching a reflected XSS lure aimed at Captive Portal or Clientless VPN users. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: XSS Payload in Request to GlobalProtect Portal or Gateway URL (Proxy)
description: Detects proxy-logged requests to GlobalProtect or SSL-VPN URL paths where
the URL contains script tags, javascript, URIs or inline event handlers (plain or
URL-encoded). This is the typical shape of a reflected XSS lure link used for phishing
or credential theft against PAN-OS GlobalProtect users. Matches the technique pattern,
not a specific parameter name.
tags:
- attack.initial-access
- attack.t1189
- attack.reconnaissance
- attack.t1598
logsource:
category: proxy
detection:
selection_path:
c-uri|contains:
- /global-protect/
- /ssl-vpn/
selection_payload:
c-uri|contains:
- <script
- '%3Cscript'
- '%253Cscript'
- 'javascript:'
- onerror=
- onload=
- <svg
- '%3Csvg'
- <img
- '%3Cimg'
condition: selection_path and selection_payload
falsepositives:
- Authorised web application scanners or penetration tests run against the GlobalProtect
portal
- Security tooling that replays suspicious URLs for sandbox analysis
level: medium
id: 1dd504ff-e230-5e2f-9966-46c88a4e6c3b
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-02
Reflected XSS Payload Against GlobalProtect Endpoints (Web Server Logs)
Detects web-server logged requests to GlobalProtect or SSL-VPN paths with script tags or event handlers in the query string, indicating attempted reflected XSS for phishing or credential theft. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reflected XSS Payload Against GlobalProtect Endpoints (Web Server Logs)
description: Detects requests to GlobalProtect or SSL-VPN paths where the query string
contains script tags, javascript, URIs or inline event handlers (plain or URL-encoded).
Indicates attempted reflected XSS against the portal or gateway, which attackers
use to phish or steal credentials from Captive Portal and Clientless VPN users.
tags:
- attack.reconnaissance
- attack.t1598
- attack.initial-access
- attack.t1189
logsource:
category: webserver
detection:
selection_path:
cs-uri-stem|contains:
- /global-protect/
- /ssl-vpn/
selection_payload:
cs-uri-query|contains:
- <script
- '%3Cscript'
- '%253Cscript'
- 'javascript:'
- onerror=
- onload=
- <svg
- '%3Csvg'
- <img
- '%3Cimg'
condition: selection_path and selection_payload
falsepositives:
- Scheduled vulnerability scans or red-team exercises against the VPN portal
level: medium
id: aaeaa41d-6794-51b9-8adb-e4729ea7cc2b
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-02
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-02
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs