# Siemens Industrial Edge devices path traversal flaws

Published: 2026-10-22 · Severity: routine · Sectors: Manufacturing, Transportation, Energy, Healthcare, Financial Services, Government (National)
Canonical: https://vorant.io/reports/62fda64f-b53e-5588-8ab7-b6611a7a1ee6/siemens-industrial-edge-devices-path-traversal-flaws

> Siemens patched two path traversal vulnerabilities in Industrial Edge devices and SIMATIC/SCALANCE HMI products allowing authenticated attackers to access sensitive internal data.

CISA republished a Siemens ProductCERT advisory (SSA-832641) describing two path traversal vulnerabilities affecting a broad range of Siemens Industrial Edge products. CVE-2026-44414 impacts Industrial Edge Cloud/Own/Virtual Devices, SCALANCE LPE9413/LPE9433, SIMATIC IoT2050 devices, and various SIMATIC IPC Industrial Edge Devices, with a CVSS v3 score of 9.1. CVE-2026-44415 affects a large family of SIMATIC and SIPLUS HMI MTP Unified Comfort Panel and Comfort Pro products. Both flaws stem from improper limitation of pathnames ('.../...//' style traversal) that could allow an authenticated remote attacker to access sensitive internal information outside the intended directory scope.

Siemens has released fixed versions for several affected products and recommends updating to the latest release; fixes for remaining products are still in preparation, with interim mitigations recommended. There is no indication in the advisory of active exploitation in the wild. Affected sectors span critical manufacturing, transportation, energy, healthcare, financial services, and government facilities, with deployments worldwide.

Defenders operating Siemens Industrial Edge or affected HMI/IPC hardware should inventory devices against the listed model numbers and firmware versions, apply vendor patches where available, and in the interim restrict network exposure of control system devices, isolate them behind firewalls from business networks, and require VPN access for remote management per Siemens' and CISA's standard ICS hardening guidance.

## Mentioned in this report

- Vulnerabilities: CVE-2026-44414, CVE-2026-44415

## Detection guidance (public sample)

### Web Request with Triple-Dot Path Traversal Sequence (Siemens Industrial Edge / HMI Style)

ATT&CK: T1083

Detects HTTP requests whose path or query contains '.../...//' or '....//' traversal sequences, the filter-evasion pattern described for the Siemens Industrial Edge and Unified Comfort Panel path traversal flaws (CVE-2026-44414 and CVE-2026-44415). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Request with Triple-Dot Path Traversal Sequence (Siemens Industrial Edge
  / HMI Style)
description: Detects HTTP requests to a web server or reverse proxy fronting an ICS
  or HMI device where the URI carries the '.../...//' or '....//' traversal sequences
  used to evade naive dot-dot-slash filtering. This matches the improper pathname
  limitation described in SSA-832641. Only visible where web or proxy logs for these
  devices are collected.
tags:
- attack.discovery
- attack.t1083
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_stem:
    cs-uri-stem|contains:
    - '.../...//'
    - '....//'
    - '...\...\\'
  selection_query:
    cs-uri-query|contains:
    - '.../...//'
    - '....//'
    - '...\...\\'
  condition: 1 of selection_*
falsepositives:
- Vulnerability scanners run by the asset owner against ICS web interfaces
- Web applications that legitimately pass relative path strings with repeated dots
  in query parameters
level: medium
id: 326dbc1a-2f0d-504e-8ac5-9368f7e1af12
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-17
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-17

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/62fda64f-b53e-5588-8ab7-b6611a7a1ee6/siemens-industrial-edge-devices-path-traversal-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup