CVE-2026-67367CWE-23

CVE-2026-67367

High · published September 8, 2026

CVSS v3.1
8.6
EPSS
1%
Percentile
65.5
In the wild
Unconfirmed
What it is

A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All versions < V3.2.4), SIMOVE Fleetmanager V3.3 (All versions < V3.3.2), SIMOVE Fleetmanager V4.0 (All versions < V4.0.1), SIPLANT V1.7 (All versions), SIPLANT V2.2 (All versions), SIPLANT V3.0 (All versions), SIPLANT V3.1 (All versions < V3.1.4). Affected devices do not properly validate and neutralize directory traversal sequences in the file-serving endpoint of the embedded HTTP server. This could allow an unauthenticated remote attacker to read arbitrary files from the underlying operating system without any credentials, potentially exposing sensitive data such as credential stores, private keys, and configuration secrets.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.01106 · 65.5th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2026-09-08T13:18Z
References (1)
https://cert-portal.siemens.com/productcert/html/ssa-517424.html · [email protected]
EPSS history
Timeline
  • 09 SEP 03:20Z
    EPSS moved — → 1%
    epss
  • 08 SEP 08:11Z
    A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All versions < V3.2.4), SIMOVE Fleetmanager…
    cvelistv5