Full Report
SIMOVE Fleetmanager and SIPLANT contain a path traversal vulnerability that could allow an attacker to access files outside of intended scope. Siemens has released new versions for the affected products and recommends to update to the latest versions.
Analysis Summary
# Vulnerability: Path Traversal in SIMOVE Fleetmanager and SIPLANT
## CVE Details
- **CVE ID:** CVE-2026-67367
- **CVSS Score:** 8.6 (High) / 9.2 (Critical)
* *Note: CVSS v3.1 is 8.6; CVSS v4.0 is 9.2.*
- **CWE:** CWE-23 (Relative Path Traversal)
## Affected Systems
- **Products:**
* SIMOVE Fleetmanager (Fleet management for AGVs)
* SIPLANT (Advanced Line Monitoring for production processes)
* Shopfloor IT Suite
- **Versions:**
* **SIMOVE Fleetmanager V3.1:** All versions < V3.1.13
* **SIMOVE Fleetmanager V3.2:** All versions < V3.2.4
* **SIMOVE Fleetmanager V3.3:** All versions < V3.3.2
* **SIMOVE Fleetmanager V4.0:** All versions < V4.0.1
* **SIPLANT V1.7, V2.2, V3.0:** All versions
* **SIPLANT V3.1:** All versions < V3.1.4
- **Configurations:** Systems utilizing the embedded HTTP server for file-serving.
## Vulnerability Description
Affected devices fail to properly validate and neutralize directory traversal sequences (e.g., `../`) within the file-serving endpoint of the embedded HTTP server. An attacker can exploit this by sending specially crafted requests to the server to navigate outside the intended web root directory. This allows for the unauthorized reading of arbitrary files from the underlying operating system.
## Exploitation
- **Status:** Not currently reported as exploited in the wild (per advisory date).
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
- **Authentication:** None (Unauthenticated)
## Impact
- **Confidentiality:** High (Access to sensitive data, including credential stores, private keys, and configuration secrets).
- **Integrity:** None
- **Availability:** None
- **Scope:** Changed (Impact extends to the underlying operating system).
## Remediation
### Patches
Siemens recommends updating to the following versions:
- **SIMOVE Fleetmanager V3.1:** Update to V3.1.13 or later.
- **SIMOVE Fleetmanager V3.2:** Update to V3.2.4 or later.
- **SIMOVE Fleetmanager V3.3:** Update to V3.3.2 or later.
- **SIMOVE Fleetmanager V4.0:** Update to V4.0.1 or later.
- **SIPLANT V3.1:** Update to V3.1.4 or later.
- **SIPLANT V1.7, V2.2, V3.0:** Contact Siemens customer support ([email protected]) for remediation steps.
### Workarounds
- **Network Segmentation:** Restrict network access to affected devices to trusted users and systems only.
- **Privilege Limitation:** Configure user management to restrict the service's access rights to only necessary project files, limiting what the path traversal can reach.
- **Industrial Security Guidelines:** Adhere to Siemens’ operational guidelines for Industrial Security.
## Detection
- **Indicators of Compromise:** Unusual HTTP GET requests containing path traversal sequences (e.g., `%2e%2e%2f`, `..%2f`, or `..\`) targeting the file-serving endpoint.
- **Detection Methods:**
* Monitor HTTP server logs for access to sensitive system files (e.g., `/etc/passwd`, Windows configuration files).
* Deploy Intrusion Detection System (IDS) signatures specifically looking for directory traversal attempts against SIMOVE and SIPLANT web interfaces.
## References
- **Vendor Advisory:** hxxps://cert-portal.siemens[.]com/productcert/html/ssa-517424.html
- **Siemens Industrial Security:** hxxps://www.siemens[.]com/industrialsecurity
- **Operational Guidelines:** hxxps://www.siemens[.]com/cert/operational-guidelines-industrial-security