Siemens Siemens ROS#
ROS# contains a ROS service file_server, that before version 2.2.2 contains a path traversal vulnerability which could allow an attacker to access, i.e. read and write, arbitrary files, which are accessible with the user rights of the user that runs the service, on the system that hosts service. Siemens has released a new version for ROS# and recommends to update to the latest version.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-41551US | — | Exploit | ||
A vulnerability has been identified in ROS# (All versions < V2.2.2). Affected versions contain a path traversal vulnerability because user input is not properly sanitized.
This co… | ||||
references
External citations — patches, advisories, analysis.
- SSA-357982: Path Traversal Vulnerability in ROS# Before 2.2.2 - CSAF Versionself
- SSA-357982: Path Traversal Vulnerability in ROS# Before 2.2.2 - HTML Versionself
- ICS Advisory ICSA-26-134-08 JSONself
- ICS Advisory ICSA-26-134-08 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (2)
- MitigationROS#
For versions before 2.2.2: - run file_server on a trusted network only. - run file_server with appropriate user rights. - run file_server only for tasks it was designed for, transferring URDF files from ROS host to target system, not as a service that runs continuously in the background. - run file_server only if manually transferring files is not possible.
- FixedROS#
Update to V2.2.2 or later version
https://github.com/siemens/ros-sharp/releases/tag/2.2.2
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan