Read the docs
TI-2024-26084 Aliases CVE-2024-38878GHSA-6cjc-w4j3-jjh8

Path traversal in Siemens Omnivise T3000 Application Server R9.2

Priority MEDIUM 44CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivise T3000 R8.2 SP4 (All versions). Affected devices allow authenticated users to export diagnostics data. The corresponding API endpoint is susceptible to path traversal and could allow an authenticated attacker to download arbitrary files from the file system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.11452 96th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensOmnivise T3000 Application Server R9.2all versions—No fix listedCNA
SiemensOmnivise T3000 R8.2 SP3all versions—No fix listedCNA
SiemensOmnivise T3000 R8.2 SP4all versions—No fix listedCNA
  • Omnivise T3000 Application Server R9.2 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Omnivise T3000 R8.2 SP3 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Omnivise T3000 R8.2 SP4 VendorSiemens Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:siemens:omnivise_t3000_application_server:r9.2:*:*:*:*:*:*:*r9.2VulnerableSiemens
  • cpe:2.3:a:siemens:omnivise_t3000_application_server:r9.2:*:*:*:*:*:*:* Versions r9.2 Vulnerable ·Siemens

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-38878
  2. 2026-10-03 Alias added: GHSA-6cjc-w4j3-jjh8

References

Advisory 1

  • TI-2024-26085 Improper input validation in Siemens Omnivise T3000 Application Server R9.2 CVSS 4.0HIGH 8.7
  • TI-2024-26082 A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All… CVSS 4.0HIGH 8.5
  • TI-2024-26083 Cleartext storage of sensitive information in Siemens Omnivise T3000 Application Server… CVSS 4.0HIGH 8.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences