EUVD-2026-98379
GHSA-gxc6-fhv6-75x5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to HMI/edge device
-
DeliveryRequest restricted internal API or path
-
ExploitBypass access control via traversal (CWE-35)
-
ExecutionRead sensitive internal information
-
ImpactEscalate system access or delete data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path traversal prevention
|
| Exploitation Conditions | Requires a valid authenticated session on the affected Siemens device (vendor assessed PR:H, implying a privileged account), and the CVSS 4.0 AT:P metric signals an additional attack precondition beyond the attacker's direct control. The flaw lies in missing access restrictions on internal APIs and file paths, so no special non-default feature toggle is named - any deployment running the affected Industrial Edge Device Kit (arm64/x86-64 v1.5-v1.28) or listed SIMATIC/SIPLUS HMI Comfort Panel is affected. Exploitation is LIMITED by the need for credentials and network reachability to the management interface; a fully unauthenticated external attacker cannot trigger it, and OT networks that isolate the management plane sharply reduce exposure. |
| Impact | Siemens-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N, full VC/VI/VA:H plus subsequent-system SC/SI/SA:H) yields an 8.9 'High' score driven almost entirely by impact breadth, not ease of access. The two gating factors are PR:H (a valid, privileged authenticated session is required) and AT:P (a specific precondition must be present), which meaningfully lower real-world likelihood compared to a pure remote-unauthenticated flaw. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active exploitation - treat this as a priority for exposed/multi-user OT management interfaces but not an emergency drop-everything patch. CWE-35 (path traversal) combined with the description ('do not properly restrict access to internal APIs and paths for authenticated users') indicates a broken-access-control / traversal issue rather than the 'Authentication Bypass' implied by the input tag; since exploitation requires an already-authenticated user, calling it an authentication bypass overstates the entry conditions. Signals are internally consistent: high technical impact, authenticated and condition-gated access, no exploitation telemetry. Primary risk is in environments where many operators hold panel/edge-device accounts or where the management interface is reachable from a broad network segment. |
| Exploit ScenarioDerived | An attacker holding valid credentials on a Siemens SIMATIC HMI Comfort Panel or Industrial Edge device issues crafted requests that traverse to internal APIs and file paths that should be off-limits, reading sensitive internal information. Because CVSS is AV:N and AC:L, once authenticated the manipulation is straightforward, and the exposed data can in the worst case be leveraged to gain further unauthorized system access or delete data. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Oct 13, 2026
Authenticated, privileged remote attackers on affected Siemens Industrial Edge Device Kit installations (arm64 and x86-64, versions 1.5 through 1.28) and the listed SIMATIC/SIPLUS HMI Unified Comfort panels can reach internal APIs and file paths that the software fails to restrict, exposing sensitive internal information and - per the vendor's description - potentially enabling further unauthorized system access or deletion of data. Siemens rates this CVSS 4.0 8.9 High (AV:N/AC:L/AT:P/PR:H/UI:N with full VC/VI/VA:H on the vulnerable system plus SC/SI/SA:H on subsequent systems); our independent assessment concurs with the high impact rating but emphasizes that the score is driven by impact breadth rather than ease of access, because exploitation requires a valid privileged session and an additional attack precondition is signalled by the AT:P metric. No publicly available exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Earlier versions of this analysis (2)
Improper access controls in Siemens SIMATIC HMI Unified Comfort and Comfort Pro panels, SIPLUS HMI panels, and Industrial Edge Device Kits (ARM64 and x86-64 builds, V1.5 through V1.28) allow an authenticated, high-privileged remote user to reach internal APIs and paths that should be restricted for that role. Successful exploitation exposes sensitive internal information and, in the worst case, can be chained into broader unauthorized access to the device or deletion of data, with a CVSS 4.0 base score of 8.9 (AV:N/AC:L/AT:P/PR:H/UI:N, all impact metrics High) and a scope-changing CVSS 3.1 assessment of 9.1 (S:C). The precondition is significant: the attacker must already hold elevated credentials and the management/API interface must be network-reachable, with an additional attack requirement (AT:P) needed for reliable exploitation, and no public exploit identified at time of analysis. This is a genuinely high-severity issue in an operational-technology context, but several real-world risk signals (pre-auth access, public exploit code, confirmed active exploitation) are missing and must be stated explicitly.
Siemens SIMATIC HMI Unified/Comfort Panels, their SIPLUS HMI equivalents, and the Siemens Industrial Edge Device Kit (ARM64 and x86-64, V1.5 through V1.28) do not properly restrict authenticated users from reaching internal APIs and filesystem paths, allowing an authenticated remote attacker to read sensitive internal information and, in the worst case, pivot to unauthorized system access or delete data (CWE-35 path traversal, CVSS 9.1). Exploitation requires a valid account plus network reachability to the device's management/API interface; the supplied vector indicates PR:H (privileged account) while our independent assessment scores PR:L, and the advisory wording ('for authenticated users') suggests a broader authenticated population - this discrepancy should be resolved against the Siemens advisories. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical attack surface is limited by the fact that these are OT/ICS devices normally deployed on segmented control networks rather than internet-facing.
RemediationAI
The provided data does not confirm a specific fixed firmware or software version, so the authoritative remediation path is the two Siemens advisories, SSA-377139 and SSA-832641 (https://cert-portal.siemens.com/productcert/html/ssa-377139.html and https://cert-portal.siemens.com/productcert/html/ssa-832641.html), which list the applicable update packages and version fixes for the Industrial Edge Device Kit (arm64/x86-64) and each affected SIMATIC/SIPLUS HMI panel; apply those vendor updates per the advisory, and verify patch status with Siemens if a build is not listed. Patch status in the available input data is best described as 'patch available per vendor advisory' rather than tied to a confirmed version string, so do not assume a particular release number without checking the advisory. Because the flaw requires an authenticated, privileged session (CVSS PR:H) and an additional precondition (AT:P), the most effective compensating controls are credential and network hygiene rather than feature toggles: restrict management and internal-API reachability to a dedicated, firewalled engineering segment so that only trusted hosts can reach the device interface (trade-off: remote engineering and diagnostics must be performed from inside that segment or over a jump host); enforce least privilege and eliminate shared or vendor-default privileged accounts, rotating credentials for any account capable of reaching the management plane (trade-off: operational friction for shift-based engineering staff); and enable logging/alerting on unusual API calls, path-traversal patterns and mass file-deletion events on the device so that post-authentication abuse is detectable (trade-off: additional log volume and SIEM tuning). No specific configuration flag is named in the available data as disabling the vulnerable internal API/path access, so do not treat any single setting as a complete workaround. If devices cannot be patched immediately, isolating them from the broader IT/OT network is the recommended interim measure, accepting that this limits centralized management and telemetry until the update is applied.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The weakness class is CWE-35 (Path Traversal: '.../...//'), i.e. improper neutralization of dot-dot path sequences, combined with an authorization gap: the affected Siemens firmware/services do not restrict authenticated users' access to internal APIs and internal file paths. Because the missing control spans both path handling and access enforcement, the tags describe it as an Authentication Bypass / access-restriction defect rather than a plain directory traversal - an attacker who already holds a session can enumerate and call internal endpoints or traverse into filesystem locations that should be privileged. The CVE record enumerates affected builds through CPE entries such as cpe:2.3:a:siemens:industrial_edge_device_kit_-_arm64_v1.10 through _v1.19 (with additional arm64 and x86-64 builds v1.5-v1.28 catalogued in the tag list), reflecting Siemens' per-version product naming for the Industrial Edge Device Kit and the SIMATIC HMI MTP700/1000/1200/1500/1900/2200 Unified Comfort, Comfort Pro, Hygienic and Neutral Design panels plus SIPLUS HMI MTP700/1000/1200 Unified Comfort variants. The CVSS 4.0 vector's AT:P indicates an attack precondition beyond the attacker's direct control (for example a specific reachable interface or system state), PR:H indicates a privileged account is needed, and S:C plus high subsequent-system metrics reflect that compromise of the device can propagate impact to connected systems - a significant characteristic on factory floors where HMI panels and edge devices sit adjacent to OT control networks.
Know when Simatic Hmi Mtp1000 Unified Comfort Panel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Network-reachable internal APIs (AV:N) with simple traversal (AC:L) require only an authenticated account (PR:L; vendor used PR:H, but description says generic 'authenticated users'); reaching internal components beyond app scope sets S:C.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
3DescriptionCVE.org
Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.
Executive ViewAI
Siemens Industrial Edge Device Kit (versions 1.5 through 1.28 on arm64 and x86-64) and SIMATIC/SIPLUS HMI Unified Comfort panels contain a high-severity vulnerability that could allow authenticated privileged attackers to access sensitive internal information and potentially delete data or gain further unauthorized access. This affects industrial control environments where confidentiality and availability of operational data are critical, and no public exploit identified at time of analysis. No vendor-released patch identified at time of analysis; leadership should prioritize mitigating exposure because exploitation, though requiring privileged credentials, could lead to operational disruption or data loss.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to affected devices' management interfaces and internal APIs, enforce least privilege for privileged accounts, and monitor for anomalous API or file access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB