{"id":"CVE-2026-44415","published":"2026-10-13T10:17:16Z","modified":"2026-10-15T20:38:04Z","title":"Affected systems do not properly restrict access to internal APIs and paths for authenticated users","vendor":"Siemens","product":"Industrial Edge Device Kit - arm64 V1.10","tier":"core","eol":null,"description":{"text":"Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an improper access restriction to internal APIs and paths in Siemens Industrial Edge Device Kit - arm64 V1.10, where it can be reached through path traversal (CWE: '.../...//'). An authenticated remote attacker with high privileges and no user interaction can access sensitive internal information, which in the worst case could facilitate unauthorized system access or the deletion of data.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:19:07Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00477,"percentile":0.41198,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":9,"pulses":[{"name":"Known_Cve | Oct 22, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad8d340ce8bef7ffa79b89b","created":"2026-10-21"},{"name":"Known_Cve | Oct 21, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad7813c340f998d3db4d0bb","created":"2026-10-20"},{"name":"Known_Cve | Oct 20, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad62f708ed98220bccde9c8","created":"2026-10-19"},{"name":"Known_Cve | Oct 19, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad4ddae89608f8a66f58915","created":"2026-10-18"},{"name":"Known_Cve | Oct 18, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad38c2e0aa0d5de6ee8bb52","created":"2026-10-17"},{"name":"Known_Cve | Oct 17, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad23ab69d40bd72818ecdae","created":"2026-10-16"},{"name":"Known_Cve | Oct 16, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ad0e93a078e6220a69919cf","created":"2026-10-15"},{"name":"Known_Cve | Oct 15, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6acf9878b4135e4a2037eb34","created":"2026-10-14"},{"name":"Known_Cve | Oct 14, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6ace46861569c0833e65dba1","created":"2026-10-13"}],"provenance":"machine"},"cwes":[{"id":"CWE-35","name":"Path Traversal: '.../...//'"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-377139.html","tags":[]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-832641.html","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-98379","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98379","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44415","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":16.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":8.24,"detail":"percentile 0.4120"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.27,"detail":"9 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}