Siemens APE1808 Authentication Bypass Using an Alternate Path or Channel (CVE-2026-24858)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505269);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/01");

  script_cve_id("CVE-2026-24858");
  script_xref(name:"ICSA", value:"26-071-02");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/01/30");

  script_name(english:"Siemens APE1808 Authentication Bypass Using an Alternate Path or Channel (CVE-2026-24858)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"An Authentication Bypass Using an Alternate Path or Channel
vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0
through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0
through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0
through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0
through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiOS 7.6.0
through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through
7.2.12, FortiOS 7.0.0 through 7.0.18 may allow an attacker with a
FortiCloud account and a registered device to log into other devices
registered to other accounts, if FortiCloud SSO authentication is
enabled on those devices.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-975644.html");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-02");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-24858");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(288);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/01/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/23");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_ape1808_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:ruggedcom_ape1808_firmware" :
        {"versionEndExcluding" : "7.4.11", "family" : "APE1808"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);