IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SSA-832641: Path Traversal Vulnerabilities in Siemens Industrial Edge Devices

CRITICAL
CVSS 9.1
Date 2026-10-13T00:00:00+00:00
Source siemens-productcert
Published by Siemens ProductCERT

// Description

Siemens Industrial Edge Devices contain multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available.

// Vulnerabilities (2)

CVE ID CVSS Score Severity Description
CVE-2026-44414 6.8 medium
CVE-2026-44414. Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system.
CVE-2026-44415 9.1 critical
CVE-2026-44415. Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.

// Affected Products (54)

Vendor Product Asset Type Purdue Level Firmware
Siemens Unknown network_device -- --
Siemens Unknown rtu
L1
--
Siemens Unknown network_device -- --
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--

// Remediations (21)

Patch: Update to V3.2.0-17 or later version
Update to V3.2.0-17 or later version
Patch: Update to V1.28.1-2 or later version
Update to V1.28.1-2 or later version
Patch: Update to V1.28.1 or later version
Update to V1.28.1 or later version
Patch: Update to V1.28.1 or later version
Update to V1.28.1 or later version
Patch: Update to V3.2.0-17 or later version
Update to V3.2.0-17 or later version
Mitigation: Ensure network access to affected products is limited to trusted parties only
Ensure network access to affected products is limited to trusted parties only
Patch: Update to V3.2.0-17 or later version
Update to V3.2.0-17 or later version
Patch: Update to V3.2.0-17 or later version
Update to V3.2.0-17 or later version
Patch: Update to V3.2.0-17 or later version
Update to V3.2.0-17 or later version
Patch: Update to V1.28.1-2 or later version
Update to V1.28.1-2 or later version
Patch: Update to V3.2.0-17 or later version
Update to V3.2.0-17 or later version
Patch: Update to V1.28.1 or later version
Update to V1.28.1 or later version
Patch: Update to V3.2.0-17 or later version
Update to V3.2.0-17 or later version
Patch: Update to V1.28.1-2 or later version
Update to V1.28.1-2 or later version
Patch: Update to V1.26.2-1 or later version
Update to V1.26.2-1 or later version
Patch: Update to V1.27.1-1 or later version
Update to V1.27.1-1 or later version
Patch: Update to V1.26.2-1 or later version
Update to V1.26.2-1 or later version
Patch: Update to V1.27.1-1 or later version
Update to V1.27.1-1 or later version
Mitigation: Ensure network access to affected products is limited to trusted parties only
Ensure network access to affected products is limited to trusted parties only
Patch: Update to V1.28.0-6 or later version
Update to V1.28.0-6 or later version
Patch: Update to V1.28.0-6 or later version
Update to V1.28.0-6 or later version

// References