Threats Tagged 'cve-2026-67367'

A critical directory traversal vulnerability exists in multiple versions of SIMOVE Fleetmanager and SIPLANT products. The flaw allows unauthenticated remote attackers to read arbitrary files from the underlying operating system via the embedded HTTP server's file-serving endpoint. This can expose sensitive data such as credential stores, private keys, and configuration secrets. The vulnerability affects all versions prior to specific fixed releases in SIMOVE Fleetmanager V3.1, V3.2, V3.3, and V4.0, as well as all versions of SIPLANT V1.7, V2.2, V3.0, and versions of SIPLANT V3.1 before 3.1.4. The CVSS 3.1 base score is 8.6, indicating a critical severity with no privileges or user interaction required for exploitation.

CVE-2026-67367 is a high-severity vulnerability affecting multiple versions of Siemens SIMOVE Fleetmanager and SIPLANT products. The flaw is a relative path traversal in the embedded HTTP server's file-serving endpoint, allowing unauthenticated remote attackers to read arbitrary files on the underlying operating system. This can expose sensitive information such as credential stores, private keys, and configuration secrets. The vulnerability affects all versions prior to specific fixed releases in SIMOVE Fleetmanager V3.1, V3.2, V3.3, V4.0, and SIPLANT V3.1, as well as all versions of SIPLANT V1.7, V2.2, and V3.0. No known exploits in the wild have been reported, and no patch links were provided in the source data.