Summary
ROS# contains a ROS service file_server, that before version 2.2.2 contains a path traversal vulnerability which could allow an attacker to access, i.e. read and write, arbitrary files, which are accessible with the user rights of the user that runs the service, on the system that hosts service.
Siemens has released a new version for ROS# and recommends to update to the latest version.
Vulnerabilities 1
-
Critical 9.1CVE-2026-41551 Public exploit
A vulnerability has been identified in ROS# (All versions < V2.2.2). Affected versions contain a path traversal vulnera…
Revision history
-
#2
Initial CISA Republication of Siemens ProductCERT SSA-357982 advisory
-
#1
Publication Date
References
-
SSA-357982: Path Traversal Vulnerability in ROS# Before 2.2.2 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-357982.html
-
ICS Advisory ICSA-26-134-08 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-08
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b