Security readout for executives and security teams
Plain-English summary
Affected Siemens SIMOVE Fleetmanager and SIPLANT systems can expose files from their underlying operating system to an unauthenticated remote attacker. Stolen files could include credentials, private keys, and configuration secrets, potentially enabling broader compromise. The issue is remotely reachable through the embedded web server and requires no user interaction.
Executive priority
Treat internet-accessible or broadly reachable affected systems as an immediate remediation priority. Patch supported branches, isolate systems lacking a named fixed release, and investigate possible secret exposure. Even without confirmed active exploitation, successful abuse could disclose credentials or private keys that enable wider operational compromise.
Technical view
CVE-2026-67367 is a CWE-23 directory traversal flaw in the embedded HTTP server’s file-serving endpoint. Improper validation and neutralization of traversal sequences permits unauthenticated arbitrary file reads. CVSS 4.0 rates it 9.2 because exploitation is network-accessible, low complexity, credential-free, and can cause high confidentiality impact without directly affecting integrity or availability.
Likely exposure
Exposure exists where an affected device’s embedded HTTP service is reachable by untrusted clients or compromised internal systems. Affected releases include SIMOVE Fleetmanager versions below specified fixed releases and all listed SIPLANT V1.7, V2.2, and V3.0 versions. The bundle provides no deployment prevalence or internet-exposure data.
Exploitation context
The source bundle does not report active exploitation, and the CVE is not identified as being in KEV. Nevertheless, unauthenticated network access, low attack complexity, and potentially sensitive file disclosure make exposed systems attractive targets. No public proof-of-concept status is established by the supplied evidence.
Researcher notes
The affected endpoint fails to neutralize directory traversal sequences, enabling arbitrary operating-system file reads without authentication. The supplied CVSS vector indicates confidentiality impact only, including subsequent-system confidentiality impact; it does not establish direct modification or denial of service. Testing should remain authorized and non-destructive. Exact endpoint details, indicators, and branch-specific workarounds are not included in the bundle.
Mitigation direction
- Upgrade SIMOVE Fleetmanager to V3.1.13, V3.2.4, V3.3.2, or V4.0.1, as applicable.
- Upgrade SIPLANT V3.1 to V3.1.4 or later.
- For affected SIPLANT branches without a named fixed release, obtain current remediation guidance from Siemens.
- Restrict embedded HTTP access to explicitly authorized management systems and trusted network segments.
- Review potentially exposed credentials, private keys, and secrets; rotate them when disclosure cannot be excluded.
Validation and detection
- Inventory SIMOVE Fleetmanager and SIPLANT deployments, recording product branch and exact installed version.
- Confirm upgraded versions meet or exceed the fixed releases identified in the advisory.
- Verify firewall and segmentation controls prevent untrusted access to each embedded HTTP service.
- Review HTTP and security logs for unusual file requests or suspected traversal activity.
- Check whether sensitive files were accessible, then assess related credentials and keys for possible exposure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-23: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-67367 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.2 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N——siemensCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N3.94siemensVulnerability scoring details
Base CVSS 4.0 score
9.2CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://cert-portal.siemens.com/productcert/html/ssa-517424.htmlCVE reference, siemens
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Relative Path Traversal
Relative Path Traversal represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.