CVE-2026-41551 is a relative path traversal vulnerability in Siemens ROS# affecting all versions before 2.2.2. The vulnerability arises because user-supplied input is not properly sanitized, enabling remote attackers to traverse directories and access arbitrary files on the device. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. No official patch or remediation level has been published by Siemens as of the vulnerability disclosure date.

Successful exploitation allows unauthenticated remote attackers to read arbitrary files on the affected device, potentially exposing sensitive information and compromising system integrity. There is no impact on availability reported. The vulnerability is rated critical due to the ease of exploitation and the high confidentiality and integrity impact.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected ROS# instances and monitor for suspicious activity related to file access attempts. Avoid exposing the vulnerable versions to untrusted networks.