Description

A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All versions < V3.2.4), SIMOVE Fleetmanager V3.3 (All versions < V3.3.2), SIMOVE Fleetmanager V4.0 (All versions < V4.0.1), SIPLANT V1.7 (All versions), SIPLANT V2.2 (All versions), SIPLANT V3.0 (All versions), SIPLANT V3.1 (All versions < V3.1.4). Affected devices do not properly validate and neutralize directory traversal sequences in the file-serving endpoint of the embedded HTTP server. This could allow an unauthenticated remote attacker to read arbitrary files from the underlying operating system without any credentials, potentially exposing sensitive data such as credential stores, private keys, and configuration secrets.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-09-08T09:18:20.577Z",
  "pubdate": "2026-09-08T09:18:20.577Z",
  "executiveSummary": "A critical path traversal vulnerability exists within the file-serving endpoints of the embedded HTTP servers used in SIMOVE Fleetmanager and SIPLANT product lines. The vulnerability arises from improper validation and neutralization of user-supplied input containing directory traversal sequences, such as '../'.\nThis security flaw allows an unauthenticated, remote attacker to bypass intended file system boundaries and access arbitrary files stored on the underlying operating system. The successful exploitation of this vulnerability can lead to the unauthorized disclosure of sensitive information, including configuration files, credential stores, private cryptographic keys, and system secrets.\nAffected products include multiple versions of SIMOVE Fleetmanager (V3.1 < V3.1.13, V3.2 < V3.2.4, V3.3 < V3.3.2, V4.0 < V4.0.1) and SIPLANT (V1.7, V2.2, V3.0, and V3.1 < V3.1.4). Given the severity of potential data exfiltration and the lack of authentication requirements, this vulnerability presents a high risk to the confidentiality and integrity of the affected industrial management systems.\nAttackers do not require valid credentials or local network access beyond the capability to reach the HTTP server endpoint to execute this attack.",
  "technicalDetails": "The vulnerability is rooted in the insufficient sanitization of input parameters processed by the embedded HTTP server's file-serving mechanism. When a request is made to the affected file-serving endpoint, the server fails to effectively filter or neutralize directory traversal character sequences (e.g., '..%2f', '..%5c', '../') within the requested URI path. This deficiency allows an attacker to navigate outside the designated directory structure intended for web asset hosting.\nExploitation occurs through a crafted HTTP GET request directed at the vulnerable file-serving endpoint. By appending path traversal sequences to the request URI, an attacker can escape the web root directory. For example, a request constructed as '/static/../../etc/passwd' or similar variations targeting sensitive system configuration paths can force the server to resolve the file path to an location outside of the intended application directory.\nThe attack flow proceeds as follows: First, the attacker identifies the web server's file-serving endpoint. Second, the attacker crafts a malicious request containing traversal sequences to escape the file system sandbox. Third, the HTTP server process, running with its associated service account privileges, accepts the malformed request, fails to normalize the path, and subsequently accesses the requested system file. Finally, the server returns the contents of the sensitive file directly in the HTTP response body to the attacker.\nThis vulnerability is particularly dangerous because the embedded HTTP server often operates with sufficient privileges to read core configuration files or environment variables that contain secrets. The scope of the impact is determined by the permissions of the user account running the HTTP server service. If the service is running as a highly privileged user or service account, an attacker could potentially gain access to system-wide secrets, sensitive databases, or configuration files that disclose the topology and operational parameters of the SIMOVE or SIPLANT environments.\nThere are no authentication requirements to trigger this vulnerability, as the traversal logic is typically processed before or independently of session-based access controls within the web application layer. The network exposure is limited only by the reachability of the HTTP management port, making any exposed instance a target for unauthorized data exfiltration."
}