External risk intelligence

SIMOVE and SIPLANT Directory Traversal Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-67367

The vulnerability affects embedded HTTP servers within fleet management and plant management software. These products are commonly deployed as web-based interfaces or management portals, which are frequently exposed to network access for remote administration or operational monitoring, making public or external network reachability a common deployment pattern.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been discovered in SIMOVE Fleetmanager and SIPLANT software, impacting how they handle file requests. This flaw could allow unauthorized remote attackers to access sensitive files on the underlying operating system, potentially exposing critical information like credentials and private keys.

Attackers can read sensitive system files.
This could expose critical company data.
Confirm relevance and exposure of affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to the file-serving endpoint of the embedded HTTP server. This allows them to traverse directory structures and access sensitive files on the underlying operating system, potentially leading to the exposure of confidential information.

Unauthenticated remote network access required.
Directory traversal sequences in file-serving endpoint.
Arbitrary file reads from the operating system.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated remote attacker could read arbitrary files from the underlying operating system of affected SIMOVE Fleetmanager and SIPLANT devices, potentially exposing sensitive system data like credentials and secrets.

Sensitive system files could be accessed.
Directory traversal in the file-serving endpoint.
Exposure of system secrets and credentials.

Operational Fix

Recommended remediation, mitigation, and detection steps

The identification and remediation of this vulnerability will likely involve both the application owners responsible for SIMOVE Fleetmanager and SIPLANT, and the infrastructure or platform teams managing the underlying operating systems and network access. The initial practical move is to inventory all instances of the affected software, confirm their network exposure and business criticality, and then engage the respective system owners to prioritize remediation efforts, possibly in coordination with the vendor.

Application and infrastructure owners are responsible.
Verify system exposure and business criticality first.
Plan coordinated vendor-supported remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SIMOVE Fleetmanager and SIPLANT?

SIMOVE Fleetmanager and SIPLANT are industrial software solutions designed for fleet management and plant operations. They typically include embedded HTTP servers that provide web-based interfaces, allowing operators to monitor and manage technical systems. These platforms act as central portals for overseeing complex industrial workflows and assets.

What does CWE-23 mean for CVE-2026-67367?

CWE-23 refers to a directory traversal weakness. In the context of CVE-2026-67367, the software fails to properly sanitize file paths in requests sent to its web server. This allows a remote attacker to manipulate input to escape the intended directory, effectively reading files located anywhere on the underlying operating system that the application has permissions to access.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted request to the file-serving endpoint of the application's embedded web server. The flaw relies on the server incorrectly handling traversal sequences, such as dot-dot-slash patterns. Notably, this does not require any authentication or user interaction; if the server receives a malicious request, it can be coerced into serving unintended files from the system.

Why does Halo Surface Signal categorize this as likely exposed?

Halo Surface Signal identifies this as a likely risk because SIMOVE and SIPLANT software are frequently deployed as web-based management portals. These interfaces are often configured with network access to facilitate remote monitoring and administration, which naturally increases the probability of them being reachable from external or public-facing network segments.

What are the first steps to address this vulnerability?

Begin by inventorying all instances of SIMOVE Fleetmanager and SIPLANT across your environment to identify which versions are in use. Once identified, evaluate the network accessibility of each instance to determine which are reachable by unauthorized parties. Finally, coordinate with your infrastructure teams to prioritize updating affected systems to the vendor-recommended versions to resolve the file-serving flaw.

References

cert-portal.siemens.com/productcert/html/ssa-517424.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.