Siemens RUGGEDCOM APE1808 vulnerable to PAN-OS buffer overflow
Siemens RUGGEDCOM APE1808 devices affected by critical Palo Alto PAN-OS buffer overflow allowing unauthenticated remote code execution with root privileges.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-0300 as exploited in the wild.
A critical buffer overflow vulnerability (CVE-2026-0300) has been identified in the User-ID Authentication Portal (Captive Portal) service of Palo Alto Networks PAN-OS software running on Siemens RUGGEDCOM APE1808 devices. An unauthenticated attacker can exploit this vulnerability by sending specially crafted packets to execute arbitrary code with root privileges on affected PA-Series and VM-Series firewalls. All versions of RUGGEDCOM APE1808 devices are vulnerable.
Siemens is preparing fix versions and has recommended several mitigations while patches are being developed. Organizations should disable Response Pages in Interface Management Profiles on untrusted interfaces, disable the User-ID Authentication Portal if not required, and restrict access to trusted internal IP addresses only. The vulnerability affects critical manufacturing sectors worldwide.
CISA recommends minimizing network exposure for affected control system devices, ensuring they are not accessible from the internet, and isolating them behind firewalls. Organizations should consult Palo Alto Networks' upstream security notifications and contact Siemens customer support for patch information.
Mentioned in this report
Detection guidance
Anomalously Large Requests to PAN-OS Captive Portal Endpoint (Possible Buffer Overflow Attempt)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Flags unusually large HTTP requests or oversized parameters sent to the PAN-OS Captive Portal / User-ID authentication endpoint, consistent with buffer overflow exploitation attempts against CVE-2026-0300. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Oversized Request to PAN-OS Captive Portal Authentication Endpoint
id: bde617b1-82d4-5b39-93b3-5464103dcf60
status: experimental
description: 'Detects abnormally large HTTP requests or request bodies directed at
the PAN-OS Captive Portal /
User-ID Authentication Portal endpoint. CVE-2026-0300 is a buffer overflow in this
service reached
by sending specially crafted (oversized/malformed) packets, allowing unauthenticated
root code
execution on Siemens RUGGEDCOM APE1808 devices. Legitimate captive portal authentication
requests
are small; requests far exceeding typical size for this endpoint warrant investigation.
'
logsource:
category: proxy
product: null
detection:
selection:
cs-uri-stem|contains:
- /global-protect/portal
- /captive-portal
- /php/uid.php
large_request:
cs-bytes|gt: 8192
condition: selection and large_request
fields:
- c-ip
- cs-uri-stem
- cs-bytes
- sc-status
falsepositives:
- Bulk certificate or multi-factor authentication payloads legitimately exceeding
normal request size
- Vulnerability scanners or health-check tools probing the portal with large synthetic
payloads
level: medium
tags:
- attack.t1190
- attack.initial-access
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-139-02
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs