A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All versions < V3.2.4), SIMOVE… (CVE-2026-67367)

SIMOVE Fleetmanager versions prior to V3.1.13, V3.2.4, V3.3.2, and V4.0.1, and SIPLANT versions including all of V1.7, V2.2, V3.0, and versions of V3.1 before 3.1.4, contain a directory traversal vulnerability (CWE-23) in the embedded HTTP server's file-serving endpoint. This vulnerability allows unauthenticated remote attackers to bypass normal file access restrictions and read arbitrary files on the system. Sensitive information such as credential stores, private keys, and configuration secrets may be exposed. The vulnerability has a CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), reflecting high impact on confidentiality without requiring privileges or user interaction. No known exploits are reported in the wild. The affected products are not cloud services, and no patch links were provided in the source data.

Successful exploitation allows unauthenticated remote attackers to read arbitrary files on the affected systems, potentially exposing highly sensitive information including credential stores, private keys, and configuration secrets. This compromises confidentiality but does not affect integrity or availability. The vulnerability has a critical severity rating with a CVSS score of 8.6.

The vulnerability affects all versions prior to SIMOVE Fleetmanager V3.1.13, V3.2.4, V3.3.2, V4.0.1, and SIPLANT V3.1.4, and all versions of SIPLANT V1.7, V2.2, and V3.0. Users should upgrade to these fixed versions where available. Since no patch links were provided, users should consult the official vendor advisories or support channels for the availability of patches or updates. Until patched, restricting network access to the embedded HTTP server and monitoring for suspicious file access attempts may reduce exposure. Patch status is not yet confirmed from the provided data — check the vendor advisory for current remediation guidance.