# Siemens RUGGEDCOM APE1808 XSS via Palo Alto GlobalProtect

Published: 2025-06-12 · Severity: routine · Sectors: manufacturing
Canonical: https://vorant.io/reports/24545fc7-aeeb-50e1-b2b5-f279637226fb/siemens-ruggedcom-ape1808-xss-via-palo-alto-globalprotect

> Reflected XSS in Palo Alto GlobalProtect portal enables credential theft for authenticated users clicking malicious links.

A reflected cross-site scripting vulnerability in Palo Alto Networks GlobalProtect gateway and portal features affects Siemens RUGGEDCOM APE1808 devices running PAN-OS software with GlobalProtect enabled. When an authenticated Captive Portal user clicks a specially crafted link, an attacker can execute arbitrary JavaScript in their browser context, enabling phishing attacks and credential theft—particularly if Clientless VPN is enabled. The vulnerability requires user interaction and network access but has low attack complexity. CVSS v3 score is 4.3 and CVSS v4 is 5.1. No known public exploitation has been reported to CISA as of the advisory date.

The affected equipment is deployed worldwide in critical manufacturing sectors. Siemens recommends disabling Clientless VPN as an immediate workaround and contacting customer support for patching. Defenders should minimize network exposure, isolate control system networks behind firewalls, restrict internet accessibility, and implement general phishing awareness and email filtering to defend against social engineering exploitation of this vector.

## Mentioned in this report

- Vulnerabilities: CVE-2025-0133 (templated)

## Detection guidance (public sample)

### XSS Payload in Request to GlobalProtect Portal or Gateway URL (Proxy)

ATT&CK: T1189

Detects proxy-logged requests to GlobalProtect or SSL-VPN paths whose URL carries script tags, javascript: URIs or inline event handlers, matching a reflected XSS lure aimed at Captive Portal or Clientless VPN users. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: XSS Payload in Request to GlobalProtect Portal or Gateway URL (Proxy)
description: Detects proxy-logged requests to GlobalProtect or SSL-VPN URL paths where
  the URL contains script tags, javascript, URIs or inline event handlers (plain or
  URL-encoded). This is the typical shape of a reflected XSS lure link used for phishing
  or credential theft against PAN-OS GlobalProtect users. Matches the technique pattern,
  not a specific parameter name.
tags:
- attack.initial-access
- attack.t1189
- attack.reconnaissance
- attack.t1598
logsource:
  category: proxy
detection:
  selection_path:
    c-uri|contains:
    - /global-protect/
    - /ssl-vpn/
  selection_payload:
    c-uri|contains:
    - <script
    - '%3Cscript'
    - '%253Cscript'
    - 'javascript:'
    - onerror=
    - onload=
    - <svg
    - '%3Csvg'
    - <img
    - '%3Cimg'
  condition: selection_path and selection_payload
falsepositives:
- Authorised web application scanners or penetration tests run against the GlobalProtect
  portal
- Security tooling that replays suspicious URLs for sandbox analysis
level: medium
id: 1dd504ff-e230-5e2f-9966-46c88a4e6c3b
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-02
```

### Reflected XSS Payload Against GlobalProtect Endpoints (Web Server Logs)

ATT&CK: T1598

Detects web-server logged requests to GlobalProtect or SSL-VPN paths with script tags or event handlers in the query string, indicating attempted reflected XSS for phishing or credential theft. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Reflected XSS Payload Against GlobalProtect Endpoints (Web Server Logs)
description: Detects requests to GlobalProtect or SSL-VPN paths where the query string
  contains script tags, javascript, URIs or inline event handlers (plain or URL-encoded).
  Indicates attempted reflected XSS against the portal or gateway, which attackers
  use to phish or steal credentials from Captive Portal and Clientless VPN users.
tags:
- attack.reconnaissance
- attack.t1598
- attack.initial-access
- attack.t1189
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
    - /global-protect/
    - /ssl-vpn/
  selection_payload:
    cs-uri-query|contains:
    - <script
    - '%3Cscript'
    - '%253Cscript'
    - 'javascript:'
    - onerror=
    - onload=
    - <svg
    - '%3Csvg'
    - <img
    - '%3Cimg'
  condition: selection_path and selection_payload
falsepositives:
- Scheduled vulnerability scans or red-team exercises against the VPN portal
level: medium
id: aaeaa41d-6794-51b9-8adb-e4729ea7cc2b
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-02
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-02

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/24545fc7-aeeb-50e1-b2b5-f279637226fb/siemens-ruggedcom-ape1808-xss-via-palo-alto-globalprotect.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup