CVE-2026-67367: SIMOVE Fleetmanager Path Traversal Flaw

CVE-2026-67367 Overview

CVE-2026-67367 is a directory traversal vulnerability [CWE-23] affecting Siemens SIMOVE Fleetmanager and SIPLANT products. The embedded HTTP server fails to validate and neutralize directory traversal sequences in its file-serving endpoint. An unauthenticated remote attacker can read arbitrary files from the underlying operating system. Exposed data may include credential stores, private keys, and configuration secrets, enabling follow-on compromise of connected systems.

Critical Impact
Unauthenticated remote attackers can read arbitrary files from affected devices, exposing credentials, private keys, and sensitive configuration data.

Affected Products

SIMOVE Fleetmanager V3.1 (versions < V3.1.13), V3.2 (< V3.2.4), V3.3 (< V3.3.2), and V4.0 (< V4.0.1)
SIPLANT V1.7, V2.2, and V3.0 (all versions)
SIPLANT V3.1 (versions < V3.1.4)

Discovery Timeline

2026-09-08 - CVE-2026-67367 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-67367

Vulnerability Analysis

The vulnerability resides in the file-serving endpoint of the embedded HTTP server used by SIMOVE Fleetmanager and SIPLANT devices. The endpoint accepts user-supplied path components without normalizing or rejecting relative traversal sequences such as ../. An attacker can escape the intended web root and read files anywhere the server process has read access.

Because the endpoint does not require authentication, exploitation only requires network reachability to the device's HTTP service. Successful reads can expose password files, TLS private keys, application configuration containing credentials, and operational data used to authenticate to downstream systems.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory, classified as [CWE-23]. The file-serving handler concatenates request-derived path segments with a base directory without canonicalizing the resulting path or verifying it remains within the intended root. Directory traversal metacharacters propagate directly to filesystem read operations.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP GET request to the vulnerable file endpoint containing traversal sequences that resolve outside the intended document root. No user interaction, privileges, or prior foothold is required. See the Siemens Security Advisory SSA-517424 for technical details.

Detection Methods for CVE-2026-67367

Indicators of Compromise

HTTP requests to the device's file-serving endpoint containing traversal sequences such as ../, URL-encoded variants (%2e%2e%2f), or double-encoded forms (%252e%252e%252f).
Access log entries referencing sensitive filesystem paths such as /etc/passwd, /etc/shadow, private key stores, or application configuration files.
Anomalous read activity on the embedded HTTP server originating from external or unexpected internal IP addresses.

Detection Strategies

Deploy network intrusion detection signatures that flag path traversal patterns in HTTP request URIs targeting Siemens SIMOVE Fleetmanager and SIPLANT device IP ranges.
Correlate outbound HTTP responses of unusual size or content type from affected devices against a baseline of legitimate file-serving behavior.
Inspect web server logs on the embedded HTTP service for requests containing encoded or nested traversal payloads.

Monitoring Recommendations

Centralize device HTTP access logs in a SIEM and alert on traversal sequences or requests referencing non-web filesystem paths.
Monitor for unauthenticated access to the file-serving endpoint from network segments that should not communicate with operational technology assets.
Track authentication events on systems whose credentials may have been stored on affected devices to detect credential reuse following potential disclosure.

How to Mitigate CVE-2026-67367

Immediate Actions Required

Upgrade SIMOVE Fleetmanager to V3.1.13, V3.2.4, V3.3.2, or V4.0.1 depending on the installed branch.
Upgrade SIPLANT V3.1 to V3.1.4; for SIPLANT V1.7, V2.2, and V3.0, follow vendor guidance in the Siemens Security Advisory SSA-517424 as no fixed version is listed.
Rotate any credentials, private keys, and secrets that may have been stored on affected devices.
Restrict network access to device HTTP interfaces to trusted management networks only.

Patch Information

Siemens has released fixed versions for the SIMOVE Fleetmanager V3.1, V3.2, V3.3, and V4.0 branches, as well as SIPLANT V3.1. Refer to the Siemens Security Advisory SSA-517424 for the authoritative version matrix and download instructions.

Workarounds

Place affected devices behind a firewall or VPN and block direct access to the embedded HTTP server from untrusted networks.
Apply network segmentation to isolate operational technology assets from general enterprise and internet-facing zones per IEC 62443 guidance.
Disable the embedded HTTP file-serving service if it is not required for operations.

bash

# Configuration example: restrict device HTTP access to a management subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP