VulnSocial

CVE-2026-67367

LOWCVSS 9.2 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All versions < V3.2.4), SIMOVE Fleetmanager V3.3 (All versions < V3.3.2), SIMOVE Fleetmanager V4.0 (All versions < V4.0.1), SIPLANT V1.7 (All versions), SIPLANT V2.2 (All versions), SIPLANT V3.0 (All versions), SIPLANT V3.1 (All versions < V3.1.4). Affected devices do not properly validate and neutralize directory traversal sequences in the file-serving endpoint of the embedded HTTP server. This could allow an unauthenticated remote attacker to read arbitrary files from the underlying operating system without any credentials, potentially exposing sensitive data such as credential stores, private keys, and configuration secrets.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-23

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-09-22: 209-22
Referenced assets1 URL
Full discourse2 posts
  • NewsTongue@NewsTongueX

    🔴 Siemens SIMOVE Fleetmanager, SIPLANT path traversal flaw exposes credentials Siemens released patches for path traversal vulnerability (CVE-2026-67367) affecting SIMOVE Fleetmanager versions 3.1–4.0 and SIPLANT versions 1.7–3.1. Unauthenticated remote attackers can read arbitrary files from the operating system, potentially exposing credential stores, private keys, and configuration secrets. • SIMOVE Fleetmanager V3.1 < 3.1.13, V3.2 < 3.2.4, V3.3 < 3.3.2, V4.0 < 4.0.1 • SIPLANT V1.7, V2.2, V3.0, and V3.1 < 3.1.4 • Deployed worldwide in critical manufacturing infrastructure

    0000041
    901 followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc

    TRC analysis shows attackers exploiting CVE-2026-67367 in Siemens industrial systems can read arbitrary files without authentication, accessing credential stores and private keys. This path traversal flaw creates a clear entry point for lateral movement across manufacturing networks. Runtime segmentation helps contain post-compromise activity in OT environments. #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/siemens-simove-siplant-path-traversal-cve-2026-67367

    0000040
    2.0K followersView on X

Explore more

Back to dashboard