CVE-2026-44415: CWE-35: Path Traversal: '.../...//' in Siemens Industrial Edge Device Kit - arm64 V1.10

This vulnerability (CVE-2026-44415) involves improper restriction of access to internal APIs and file paths in Siemens Industrial Edge Device Kit - arm64 V1.10. Authenticated remote attackers can leverage path traversal sequences ('.../...//') to access sensitive internal information or perform unauthorized actions such as data deletion. The flaw is classified under CWE-35 (Path Traversal) and affects versions prior to 1.26.2-1, 1.27.1-1, and 1.28.0-6. The vulnerability has a CVSS 3.1 base score of 9.1, reflecting critical severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

An authenticated remote attacker can exploit this vulnerability to access sensitive internal information or delete data, potentially leading to unauthorized system access or disruption of service. The impact includes full compromise of confidentiality, integrity, and availability of the affected system components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor Siemens advisories for updates. Until a fix is available, restrict authenticated user access to trusted personnel and limit exposure of the affected systems.