Path Traversal Vulnerability in Siemens SIMOVE and SIPLANT

Siemens has disclosed a critical path traversal vulnerability, identified as CVE-2026-67367, affecting multiple versions of SIMOVE Fleetmanager and SIPLANT. The vulnerability exists within the file-serving endpoint of the products' embedded HTTP server, which fails to properly validate and neutralize directory traversal sequences. This weakness allows an unauthenticated, remote attacker to traverse the file system and access arbitrary files located outside of the intended directory scope on the host operating system. Successful exploitation could lead to the unauthorized disclosure of sensitive information, including configuration secrets, private cryptographic keys, and credential stores. This vulnerability is particularly critical given the products' deployment in the Critical Manufacturing sector. Siemens has released patches for the affected versions and recommends that users update their systems to the latest available releases immediately.

Impact

The vulnerability poses a high risk to operational security within the Critical Manufacturing sector. Successful exploitation allows an unauthenticated remote attacker to gain unauthorized access to sensitive files on the host system. The exposure of credential stores, private keys, and configuration secrets could facilitate further lateral movement, persistent access, or compromise of connected industrial control systems.

Recommendation

• Upgrade SIMOVE Fleetmanager and SIPLANT to the versions identified as patched by Siemens (e.g., V3.1.13, V3.2.4, V3.3.2, V4.0.1, or V3.1.4 respectively).
• Implement strict network segmentation to ensure these devices are not accessible from the public internet.
• Utilize VPNs for secure remote access if necessary, ensuring the VPN infrastructure itself is patched and monitored.
• Apply the principle of least privilege by configuring user management to restrict service-level access rights to project files.
• Monitor logs for HTTP requests containing directory traversal patterns (e.g., ../, .., /etc/passwd) targeting embedded web servers in OT environments.