High severity · published Sep 8, 2026
CVE-2026-67367
A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All versions < V3.2.4), SIMOVE Fleetmanager V3.3 (All versions…
8.6
CVSS
1.1%
EPSS
No
On KEV
Description
A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All versions < V3.2.4), SIMOVE Fleetmanager V3.3 (All versions < V3.3.2), SIMOVE Fleetmanager V4.0 (All versions < V4.0.1), SIPLANT V1.7 (All versions), SIPLANT V2.2 (All versions), SIPLANT V3.0 (All versions), SIPLANT V3.1 (All versions < V3.1.4). Affected devices do not properly validate and neutralize directory traversal sequences in the file-serving endpoint of the embedded HTTP server. This could allow an unauthenticated remote attacker to read arbitrary files from the underlying operating system without any credentials, potentially exposing sensitive data such as credential stores, private keys, and configuration secrets.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
SIMOVE Fleetmanager V3.1 · Siemens
before V3.1.13 · source: vendor
SF
SIMOVE Fleetmanager V3.2 · Siemens
before V3.2.4 · source: vendor
SF
SIMOVE Fleetmanager V3.3 · Siemens
before V3.3.2 · source: vendor
SF
SIMOVE Fleetmanager V4.0 · Siemens
before V4.0.1 · source: vendor
SV
SIPLANT V1.7 · Siemens
0 · source: vendor
SV
SIPLANT V2.2 · Siemens
0 · source: vendor
SV
SIPLANT V3.0 · Siemens
0 · source: vendor
SV
SIPLANT V3.1 · Siemens
before V3.1.4 · source: vendor
