CVE-2026-67367: Siemens SIMOVE Fleetmanager and SIPLANT Path Traversal — Detection and Remediation Guide

---
title: Path Traversal Attempt in Web Request Against ICS Management Interface
id: 8f3c1a72-4d6e-4b91-a2c5-9e7f0d3b8a61
status: experimental
description: Detects URL-encoded and raw path traversal sequences in web request URIs targeting industrial management applications such as Siemens SIMOVE Fleetmanager and SIPLANT, associated with CVE-2026-67367 exploitation.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-07
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_traversal:
    cs-uri|contains:
      - '../'
      - '..\\'
      - '%2e%2e%2f'
      - '%2e%2e/'
      - '..%2f'
      - '%2e%2e%5c'
      - '%252e%252e'
      - '..;'
      - '..%00'
  selection_sensitive_target:
    cs-uri|contains:
      - 'windows'
      - 'win.ini'
      - 'system32'
      - 'boot.ini'
      - '/etc/passwd'
      - 'web.config'
      - 'applicationhost.config'
  condition: selection_traversal
falsepositives:
  - Legitimate application functionality using relative paths (review and whitelist specific endpoints)
  - Vulnerability scanners — validate source IP against approved scan ranges
level: high
---
title: ICS Management Service Reading Files Outside Application Directory
id: 2b7e9f41-c3a8-4d52-b6e1-7a4c0f2d9e83
status: experimental
description: Detects the SIMOVE Fleetmanager or SIPLANT service processes accessing sensitive Windows files outside their intended scope, indicative of successful path traversal exploitation (CVE-2026-67367).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-07
  - https://attack.mitre.org/techniques/T1003/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.credential_access
  - attack.t1003
  - attack.collection
logsource:
  category: file_event
  product: windows
detection:
  selection_process:
    Image|contains:
      - 'SIMOVE'
      - 'SIPLANT'
      - 'Fleetmanager'
  selection_target:
    TargetFilename|contains:
      - '\\Windows\\System32\\config\\'
      - '\\Windows\\win.ini'
      - '\\Windows\\repair\\'
      - '\\inetpub\\'
      - '.ssh'
      - '\\Users\\'
  filter_known:
    TargetFilename|contains:
      - '\\Users\\Public\\'
  condition: selection_process and selection_target and not filter_known
falsepositives:
  - Legitimate configuration reads during service startup — baseline during maintenance windows
level: critical
---
title: Suspicious Child Process Spawned by SIMOVE or SIPLANT Service
id: 6d1a4c98-7e2f-4b35-a9d2-3c8b1e6f5a47
status: experimental
description: Detects command shells, scripting engines, or download utilities spawned as child processes of Siemens SIMOVE Fleetmanager or SIPLANT application services, indicating post-exploitation activity following web interface compromise.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-07
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - 'SIMOVE'
      - 'SIPLANT'
      - 'Fleetmanager'
  selection_child:
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\wscript.exe'
      - '\\cscript.exe'
      - '\\mshta.exe'
      - '\\certutil.exe'
      - '\\bitsadmin.exe'
      - '\\whoami.exe'
      - '\\net.exe'
      - '\\nltest.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Vendor maintenance scripts during patching — verify against change management records
level: critical

let TraversalPatterns = dynamic(["../", "..\\", "%2e%2e", "..%2f", "%252e%252e", "..;", "..%00"]);
let SensitiveTargets = dynamic(["system32", "win.ini", "boot.ini", "web.config", "etc/passwd", "applicationhost"]);
union isfuzzy=true
    (CommonSecurityLog
    | where TimeGenerated > ago(14d)
    | where RequestURL has_any (TraversalPatterns)
    | extend Target = tolower(RequestURL)
    | extend HitsSensitive = Target has_any (SensitiveTargets)
    | project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, RequestMethod, RequestURL, HitsSensitive, DeviceVendor),
    (Syslog
    | where TimeGenerated > ago(14d)
    | where SyslogMessage has_any (TraversalPatterns)
    | where SyslogMessage has_any (dynamic(["SIMOVE", "SIPLANT", "Fleetmanager"])) or SyslogMessage has_any (SensitiveTargets)
    | project TimeGenerated, HostIP, Computer, SyslogMessage),
    (DeviceFileEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFolderPath has_any (dynamic(["SIMOVE", "SIPLANT", "Fleetmanager"]))
    | where FolderPath has_any (dynamic(["\\windows\\system32\\config", "\\windows\\win.ini", "\\users\\", "\\.ssh"]))
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName),
    (DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFolderPath has_any (dynamic(["SIMOVE", "SIPLANT", "Fleetmanager"]))
    | where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "certutil.exe", "whoami.exe", "net.exe", "nltest.exe", "bitsadmin.exe", "mshta.exe")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName)

-- Hunt SIMOVE/SIPLANT service processes, their network connections, and recently dropped files
LET procs = SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Exe =~ '(?i)simove|siplant|fleetmanager'

LET conns = SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, State
FROM netstat()
WHERE RemoteAddr !~ '^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|127\\.)'
  AND State =~ 'ESTABLISHED'

LET drops = SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['C:/Program Files*/SIMOVE/**/*.aspx', 'C:/Program Files*/SIPLANT/**/*.aspx', 'C:/inetpub/**/*.aspx', 'C:/Windows/Temp/*.exe', 'C:/Windows/Temp/*.dll', 'C:/ProgramData/**/*.ps1'])
WHERE Mtime > now() - 1209600

SELECT * FROM procs
UNION ALL
SELECT Pid, Name, format(format='%v:%v', args=[LocalAddr, LocalPort]) AS CommandLine, format(format='%v:%v', args=[RemoteAddr, RemotePort]) AS Exe, State AS Username FROM conns

# CVE-2026-67367 Exposure Assessment - SIMOVE Fleetmanager / SIPLANT
# Run as Administrator on the application host

Write-Host "=== [1] Installed Siemens Product Versions ===" -ForegroundColor Cyan
Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*, `
                HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* `
  -ErrorAction SilentlyContinue |
  Where-Object { $_.DisplayName -match 'SIMOVE|SIPLANT' } |
  Select-Object DisplayName, DisplayVersion, InstallLocation, Publisher |
  Format-Table -AutoSize

Write-Host "=== [2] Running SIMOVE/SIPLANT Services ===" -ForegroundColor Cyan
Get-CimInstance Win32_Service |
  Where-Object { $_.Name -match 'SIMOVE|SIPLANT' -or $_.PathName -match 'SIMOVE|SIPLANT' } |
  Select-Object Name, State, StartName, PathName |
  Format-List

Write-Host "=== [3] Vulnerable Version Check ===" -ForegroundColor Cyan
$installed = Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*, `
                HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* `
  -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -match 'SIMOVE|SIPLANT' }
foreach ($app in $installed) {
  $v = [version]($app.DisplayVersion -replace '[^0-9.]', '')
  $fixed = switch -Regex ($app.DisplayName) {
    'SIMOVE.*3\.1' { '3.1.13' } 'SIMOVE.*3\.2' { '3.2.4' }
    'SIMOVE.*3\.3' { '3.3.2' }  'SIMOVE.*4\.0' { '4.0.1' }
    'SIPLANT.*3\.1' { '3.1.4' } default { $null }
  }
  if ($null -eq $fixed) {
    Write-Host "[VULNERABLE - NO FIX] $($app.DisplayName) $($app.DisplayVersion) (SIPLANT V1.7/V2.2/V3.0: all versions affected)" -ForegroundColor Red
  } elseif ($v -lt [version]$fixed) {
    Write-Host "[VULNERABLE] $($app.DisplayName) $($app.DisplayVersion) < $fixed" -ForegroundColor Red
  } else {
    Write-Host "[PATCHED] $($app.DisplayName) $($app.DisplayVersion)" -ForegroundColor Green
  }
}

Write-Host "=== [4] Historical Traversal Attempts in Web Logs (last 14 days) ===" -ForegroundColor Cyan
$logPaths = @("C:\inetpub\logs\LogFiles", "C:\SIMOVE\logs", "C:\Program Files\Siemens\SIMOVE*\logs")
$cutoff = (Get-Date).AddDays(-14)
foreach ($p in $logPaths) {
  Get-ChildItem $p -Recurse -Filter *.log -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt $cutoff } |
    Select-String -Pattern '(\.\./)|(\.\.\\)|(%2e%2e)|(\.\.%2f)|(%252e)' -AllMatches |
    Select-Object Path, LineNumber, @{N='Snippet';E={$_.Line.Substring(0, [Math]::Min(200, $_.Line.Length))}} |
    Format-List
}

Write-Host "=== [5] Unexpected External Connections from Host ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $_.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|::1|fe80)' -and $_.RemoteAddress -ne '0.0.0.0' } |
  ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{ Process=$proc.ProcessName; PID=$_.OwningProcess; Remote=$_.RemoteAddress; Port=$_.RemotePort }
  } | Sort-Object Process -Unique | Format-Table -AutoSize