Siemens Industrial Edge Device Kit: Path traversal vulnerability
Summary
Siemens Industrial Edge Device Kit contains a path traversal vulnerability (CWE-35) that allows an authenticated remote attacker to reach internal APIs and paths that should be restricted. According to Siemens, an attacker can obtain sensitive internal information and, in the worst case, use it to gain unauthorized access to the system or delete data. The CVSS 4.0 vector requires high privileges (PR:H), so an ordinary authenticated user account is not sufficient.
Affected
- Industrial Edge Device Kit arm64 V1.5 to V1.28 (affected according to Siemens SSA-377139)
- Industrial Edge Device Kit x86-64 builds (affected according to Siemens SSA-377139; exact version table unverified)
- SIMATIC HMI MTP Comfort Pro and Unified Comfort Panel devices listed in SSA-832641 (affected for CVE-2026-44415)
Fixed in
- arm64 V1.26: update to V1.26.2-1 or later
- arm64 V1.27: update to V1.27.1-1 or later
- arm64 V1.28: update to V1.28.0-6 or later
- arm64 V1.5 to V1.25: no fix planned
- x86-64: Unknown.
- SIMATIC HMI MTP Comfort Pro and Unified Comfort Panel devices: no fix available
Workaround
- Limit network access to affected devices to trusted parties only and protect access with appropriate mechanisms, as recommended by Siemens.
- Follow the Siemens operational guidelines and keep devices off the internet and office networks.
Exploitation
- No exploitation in the wild is known.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No public proof of concept was found in the sources reviewed.
Our recommendation
- Check whether Siemens Industrial Edge Device Kit or affected HMI devices are in use, including third-party edge devices built on it.
- Update arm64 V1.26, V1.27 and V1.28 installations to the fixed versions.
- Plan a migration away from unfixed lines (V1.5 to V1.25 and devices without a fix).
- Isolate devices from office and guest networks and restrict access to trusted administrators.
- Monitor access logs for unusual access to internal paths.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Siemens SSA-377139: Path Traversal Vulnerabilities in Industrial Edge Device Kit cert-portal.siemens.com
- Siemens SSA-832641: Path Traversal Vulnerabilities in Siemens Industrial Edge Devices cert-portal.siemens.com
- CISA ICS Advisory ICSA-26-295-09 www.cisa.gov
- Vulners CVE record CVE-2026-44415 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:32.
Original description (NVD)
Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.