Full Report
Siemens Industrial Edge Devices contain multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available.
Analysis Summary
# Vulnerability: Path Traversal in Siemens Industrial Edge Devices
## CVE Details
- **CVE ID:** CVE-2026-44414, CVE-2026-44415
- **CVSS Score:**
- **CVE-2026-44414:** 6.8 (Medium) / 6.9 (CVSS v4.0)
- **CVE-2026-44415:** 9.1 (Critical) / 8.9 (CVSS v4.0)
- **CWE:** CWE-35: Path Traversal: '.../...//'
## Affected Systems
- **Products:**
- Industrial Edge Cloud Device (IECD)
- Industrial Edge Own Device (IEOD)
- Industrial Edge Virtual Device (IEVD)
- SCALANCE LPE9413 & LPE9433
- SIMATIC HMI Unified Comfort Panels & Unified Comfort Panel PRO family
- SIMATIC HMI MTP1200 Comfort Pro series
- **Versions:**
- IECD, IEOD, IEVD: All versions < V1.28.1
- SCALANCE and SIMATIC HMI: All versions (Current as of advisory date)
- **Configurations:** Authenticated remote access required.
## Vulnerability Description
Affected Siemens Industrial Edge devices do not properly restrict access to internal APIs and filesystem paths. By utilizing specific path traversal sequences (e.g., '.../...//'), an authenticated remote attacker can bypass directory restrictions. This allows access to sensitive internal information and, in the case of CVE-2026-44415, could permit the deletion of data or full system compromise.
## Exploitation
- **Status:** Not exploited (No reports of active exploitation in the wild or public PoC provided in advisory).
- **Complexity:** Low (Requires valid credentials but standard traversal techniques).
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Access to sensitive internal information and system files).
- **Integrity:** High (In the case of CVE-2026-44415, data deletion or unauthorized system access).
- **Availability:** High (Data deletion can lead to service disruption).
## Remediation
### Patches
- **IECD:** Update to V1.28.1 or later.
- **IEOD:** Update to V1.28.1 or later.
- **IEVD:** Update to V1.28.1 or later.
- **Other products:** Siemens is currently preparing fixes for SCALANCE and SIMATIC HMI products.
### Workarounds
- Limit access to the Industrial Edge Device Management interfaces to trusted users only.
- Ensure the devices are not exposed directly to the internet.
- Implement the "Defense-in-Depth" strategy as recommended by Siemens.
## Detection
- **Indicators of Compromise:** Unusual API requests containing directory traversal sequences (e.g., `../`, `.../`, or `%2e%2e%2f`).
- **Detection Methods:** Review system and web server logs for unauthorized access attempts to internal filesystem paths or unexpected API calls from authenticated user accounts.
## References
- Siemens ProductCERT Advisory: [https://cert-portal.siemens.com/productcert/html/ssa-832641.html](https://cert-portal.siemens.com/productcert/html/ssa-832641.html)
- Siemens Security Advisories: [https://www.siemens.com/cert/advisories](https://www.siemens.com/cert/advisories)