CVE-2026-44414: CWE-35: Path Traversal: '.../...//' in Siemens Industrial Edge Cloud Device (IECD)

This vulnerability (CVE-2026-44414) involves a path traversal issue (CWE-35) in Siemens Industrial Edge Cloud Device (IECD) and related Industrial Edge Device Kit versions for arm64 and x86-64 architectures, as well as other Siemens Industrial Edge devices. The affected systems do not properly restrict access to internal APIs and paths for authenticated users, allowing these users to access sensitive internal information. The vulnerability affects multiple versions prior to 1.28.1 and other specified version ranges. The CVSS 3.1 score is 6.8, indicating medium severity, with network attack vector, low attack complexity, high privileges required, no user interaction, and impact on confidentiality but not integrity or availability. No vendor advisory or patch information is provided, and no known exploits are reported.

An authenticated remote attacker with high privileges can exploit this vulnerability to access sensitive internal information by bypassing access restrictions to internal APIs and paths. This exposure could potentially facilitate unauthorized access to the system. The vulnerability impacts confidentiality but does not affect integrity or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor Siemens advisories for updates. Until a fix is available, restrict access to affected devices to trusted users only and apply standard access control best practices to limit exposure.