Description
A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All versions < V3.2.4), SIMOVE Fleetmanager V3.3 (All versions < V3.3.2), SIMOVE Fleetmanager V4.0 (All versions < V4.0.1), SIPLANT V1.7 (All versions), SIPLANT V2.2 (All versions), SIPLANT V3.0 (All versions), SIPLANT V3.1 (All versions < V3.1.4). Affected devices do not properly validate and neutralize directory traversal sequences in the file-serving endpoint of the embedded HTTP server. This could allow an unauthenticated remote attacker to read arbitrary files from the underlying operating system without any credentials, potentially exposing sensitive data such as credential stores, private keys, and configuration secrets.
Published: 2026-09-08
Score: 9.2 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 09 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 08 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Siemens
Siemens simove Fleetmanager V3.1
Siemens simove Fleetmanager V3.2
Siemens simove Fleetmanager V3.3
Siemens simove Fleetmanager V4.0
Siemens siplant V1.7
Siemens siplant V2.2
Siemens siplant V3.0
Siemens siplant V3.1
Vendors & Products Siemens
Siemens simove Fleetmanager V3.1
Siemens simove Fleetmanager V3.2
Siemens simove Fleetmanager V3.3
Siemens simove Fleetmanager V4.0
Siemens siplant V1.7
Siemens siplant V2.2
Siemens siplant V3.0
Siemens siplant V3.1

Tue, 08 Sep 2026 09:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Directory Traversal in SIMOVE Fleetmanager & SIPLANT HTTP Server

Tue, 08 Sep 2026 08:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All versions < V3.2.4), SIMOVE Fleetmanager V3.3 (All versions < V3.3.2), SIMOVE Fleetmanager V4.0 (All versions < V4.0.1), SIPLANT V1.7 (All versions), SIPLANT V2.2 (All versions), SIPLANT V3.0 (All versions), SIPLANT V3.1 (All versions < V3.1.4). Affected devices do not properly validate and neutralize directory traversal sequences in the file-serving endpoint of the embedded HTTP server. This could allow an unauthenticated remote attacker to read arbitrary files from the underlying operating system without any credentials, potentially exposing sensitive data such as credential stores, private keys, and configuration secrets.
Weaknesses CWE-23
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}

cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

Siemens Simove Fleetmanager V3.1 Simove Fleetmanager V3.2 Simove Fleetmanager V3.3 Simove Fleetmanager V4.0 Siplant V1.7 Siplant V2.2 Siplant V3.0 Siplant V3.1
cve-icon MITRE

Status: PUBLISHED

Assigner: siemens

Published:

Updated: 2026-09-09T15:56:42.377Z

Reserved: 2026-07-29T14:51:27.000Z

Link: CVE-2026-67367

cve-icon Vulnrichment

Updated: 2026-09-09T15:56:33.455Z

cve-icon NVD

Status : Deferred

Published: 2026-09-08T09:18:20.577

Modified: 2026-09-09T16:17:03.757

Link: CVE-2026-67367

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-08T20:35:22Z

Weaknesses