CVE-2025-61624: FortiOS Path Traversal Reaches OT via Siemens RUGGEDCOM APE1808

Executive Summary

CVE-2025-61624 is a path traversal flaw (CWE-22) across multiple Fortinet platforms that allows an attacker to reference files outside the intended restricted directory, carrying a CVSS score of 6.5. The physical criticality comes from one distribution path: this same Fortinet code runs inside the Siemens RUGGEDCOM APE1808 application processing engine, which is frequently positioned at the substation and plant edge as the security gateway between control networks and external connectivity.

Technical Exposure Breakdown

The vulnerable component is the Fortinet software stack. Per the grounding data, affected products include FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager across the version ranges published by the vendor. FortiOS is listed as vulnerable from 6.4.0 through 7.4.10 and 7.6.0 through 7.6.5, with additional branch-specific ranges in the 7.0 and 7.2 lines. FortiProxy is listed through 7.0.0-7.4.12 and 7.6.0-7.6.5. FortiSwitchManager is listed in the 7.0.0-7.0.7 and 7.2.0-7.2.8 ranges. FortiPAM is listed across the 1.0 through 1.7.1 range. Siemens RUGGEDCOM APE1808 firmware is listed as affected, with the vulnerable range not specified in the grounding data.

Path traversal in a network security appliance means an authenticated or partially authenticated request can be crafted to read or write files outside the directory the application intended to constrain. On a device that terminates VPN tunnels, enforces proxy policy, or brokers privileged access, that primitive can expose configuration material, credentials, or session artifacts, and in the worst case it provides a foothold for further access against the appliance itself. The exact preconditions and authentication requirements are not detailed in the grounding data, so operators should treat the flaw as exploitable until they confirm otherwise against their own deployment.

The RUGGEDCOM APE1808 is the pivotal case here. It is a ruggedized compute platform that hosts third-party security applications, and when it runs the Fortinet payload it inherits this vulnerability. These units are hardened for substation and field environments, which means they tend to be installed in exactly the places where patching is slowest and network exposure to the control segment is highest.

OT Impact and Compliance Risk

In an OT deployment the APE1808 often sits at the electronic security perimeter. If that gateway is the device being traversed, the component intended to enforce segmentation becomes the component that undermines it. There is no direct process manipulation in a path traversal, but a compromised or exposed perimeter appliance erodes every downstream assumption about who can reach the PLCs, RTUs, and HMIs behind it.

For NERC CIP registered entities, an APE1808 acting as an electronic access point falls under CIP-005 and CIP-007, and a known exploited vulnerability on that asset creates a patch management obligation under CIP-007 R2 along with the associated documentation of mitigation timelines. Under IEC 62443 this maps to zone and conduit integrity, specifically the SR for least functionality and the use of defense in depth rather than a single perimeter device. Pipeline operators under TSA SD-02C should treat any internet-reachable or corporate-reachable instance of these appliances as a critical cyber system requiring prioritized remediation and access control review. Water and wastewater utilities with AWIA obligations should fold this into their risk and resilience assessment if Fortinet or RUGGEDCOM appliances form part of their remote access architecture.

Compensating Controls

Confirm the patch status against the vendor advisory before assuming a fix is deployed; the grounding data lists patch status as unknown, so verification is mandatory rather than assumed. Do not run active vulnerability scans against the APE1808 or any in-line security appliance on a live control segment. Aggressive probing of these devices can disrupt tunnel termination and proxy functions and interrupt the traffic they are carrying.

For immediate mitigation, restrict management and web interface reachability to a dedicated out-of-band administration network and remove any exposure to the corporate or control VLANs that is not strictly required. Enforce multi-factor authentication on all administrative access. As a virtual patch concept, deploy a Suricata rule on the span or inline sensor in front of the appliance that inspects HTTP request paths for directory traversal sequences such as encoded and double-encoded dot-dot patterns and percent-2e sequences targeting the management service, and alert on any request attempting to escape the expected web root. Pair that with filesystem and configuration integrity monitoring so that unexpected file reads or writes on the appliance generate an event.

BreachSpider Intel

BreachSpider tracks CVE-2025-61624 and its RUGGEDCOM APE1808 distribution path across the known exploited vulnerability catalog for continuous OT exposure monitoring.