CVE Intelligence
Analysis AI-assisted

CVE-2026-41551: ROS# Path Traversal Vulnerability

CVE-2026-41551 is a path traversal vulnerability (CWE-23) in ROS# affecting versions below V2.2.2, caused by insufficient sanitization of user input. The record describes it as allowing a remote attacker to access arbitrary files on the device, and the CNA rates it as critical with CVSS 3.1 score 9.1. The sources consulted show no confirmed exploitation, and the record lists no affected product entries or fixed versions.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-41551 is a path traversal weakness (CWE-23, Relative Path Traversal) in ROS#. According to the record, the flaw exists because user-supplied input is not properly sanitized, and the affected range is all versions below V2.2.2. The CNA product CERT notice referenced in the record is Siemens SSA-357982.

Impact

  • The record states that a remote attacker could access arbitrary files on the device.
  • The CNA assigns a CVSS 3.1 base score of 9.1 and a CVSS 4.0 score of 9.3, both rated critical in the record.
  • The vulnerability is characterized by the record as requiring no privileges and no user interaction, based on the CVSS 3.1 vector reported by the CNA.

Affected products and versions

  • The description identifies ROS# versions below V2.2.2 as affected.
  • The structured affected-product list in the record is empty, so specific product names, models and build variants cannot be confirmed from the record alone.

Exploitation status

  • The record shows that CVE-2026-41551 is not listed in the CISA Known Exploited Vulnerabilities catalog.
  • No confirmed exploitation appears in the sources consulted for this analysis.
  • The FIRST EPSS estimate in the record is 0.0064 (percentile 0.49272), which is a statistical likelihood of exploitation and not evidence of exploitation.

Remediation and mitigation

  • Identify every ROS# installation and confirm its version.
  • Review the Siemens advisory at SSA-357982 for the vendor's official remediation guidance and the version that resolves the issue.
  • Because the description places the boundary at V2.2.2, systems running versions below that should be prioritized for review, but the exact fixed release should be taken from the vendor advisory.
  • Restrict network exposure of affected devices to trusted segments until the vendor remediation is applied.

Detection guidance

  • Review access logs of ROS# devices for requests that reference unusual or unexpected file paths.
  • Monitor for file access on the device that falls outside normal operational patterns.
  • Track asset inventory so that devices running affected versions are quickly identified.

Limitations of the available information

  • The record contains no structured list of affected products or fixed versions.
  • The record does not describe the specific endpoints or conditions that trigger the flaw, and this analysis does not provide them.
  • The record's EPSS date (2026-10-13) is later than its publication date and should be verified against the current EPSS feed.
  • The CNA and NVD records are the only sources used here; the vendor advisory was not reviewed in full.

Frequently asked questions

What is CVE-2026-41551?

It is a path traversal vulnerability (CWE-23) in ROS# affecting versions below V2.2.2, caused by insufficient sanitization of user input.

Is CVE-2026-41551 known to be exploited?

It is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted for this analysis.

What should administrators do now?

Identify ROS# installations, check the Siemens advisory SSA-357982 for the official fixed version, and limit network exposure until the fix is applied.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.