Siemens Industrial Edge Devices and SIMATIC HMI Panels Patched for Path Traversal Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) published advisory ICSA-26-295-17 on October 22, 2026, warning of path traversal vulnerabilities in a broad range of Siemens Industrial Edge and SIMATIC HMI products. Two CVEs are identified: CVE-2026-44414 and CVE-2026-44415.

CVE-2026-44414 affects Industrial Edge Cloud Device (versions intdot/<1.28.1), Industrial Edge Own Device (intdot/<1.28.1), Industrial Edge Virtual Device (intdot/<1.28.1), and SCALANCE LPE9413/LPE9433 (all versions). CVE-2026-44415 impacts numerous SIMATIC HMI MTP1000, MTP1200, MTP1500, and MTP1900 models across Comfort Pro and Unified Comfort Panel variants, all listed as affected regardless of version.

The vulnerabilities stem from insufficient input validation in the HTTP request handling code, potentially enabling an authenticated remote attacker to traverse file paths and access sensitive internal information. Siemens has released new versions for the affected products and recommends updating to the latest available firmware or software. For products where fixes are not yet available, Siemens advises specific mitigations as outlined in the advisory.

CISA and Siemens emphasize that exploitation requires authentication, but successful access to internal data could facilitate further compromise in industrial control environments. Users are advised to check their specific product models and versions against the advisory and apply updates through official Siemens channels.