Siemens SIMOVE Fleetmanager and SIPLANT
Siemens patched a high-severity path traversal in SIMOVE Fleetmanager and SIPLANT that can expose secrets.
CISA republished Siemens ProductCERT SSA-517424 covering CVE-2026-67367, a relative path traversal in SIMOVE Fleetmanager and SIPLANT. An unauthenticated remote attacker can read arbitrary files, including credential stores, private keys, and configuration secrets, through the embedded HTTP server. CVSS v3.1 is 8.6. Siemens has released updates for the affected Fleetmanager and SIPLANT versions.
- CVE-2026-67367 is unauthenticated path traversal in an embedded HTTP server.
- Attackers can read credential stores, private keys, and configuration files.
- Fleetmanager builds before 3.1.13, 3.2.4, 3.3.2, and 4.0.1 are affected.
- Multiple SIPLANT versions are affected; Siemens has published updates.
- CVEs
- CVE-2026-67367
- Vendors
- Siemens
- Products
- SIMOVE FleetmanagerSIPLANT
- Organizations
- SiemensCISASiemens ProductCERT
- Countries
- Germany
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-67367 | Unauthenticated Directory Traversal File Read in Siemens SIMOVE Fleetmanager and SIPLANT | 9.2 | <1% |
From the original article
3 min read at cisa.govView CSAF Summary SIMOVE Fleetmanager and SIPLANT contain a path traversal vulnerability that could allow an attacker to access files outside of intended scope. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens SIMOVE Fleetmanager and SIPLANT are affected: SIMOVE Fleetmanager V3.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.