The vulnerability in Siemens ROS# allows a remote attacker to read arbitrary files on a device by exploiting a path traversal flaw. Because the application fails to sanitize user input, an attacker can specify directory traversal sequences to access files outside the intended directory. Reading sensitive files could lead to disclosure or further compromise of system integrity.

Siemens ROS# versions earlier than 2.2.2 are impacted. The flaw exists in all releases prior to this version; no specific sub‑products are listed beyond ROS#.

The CVSS score of 9.3 classifies this as a critical vulnerability, and the lack of an EPSS rating indicates no current exploitation data but a high theoretical risk. As the issue is not listed in the CISA KEV catalog, it may not yet be widely exploited, but the remote file read capability allows attackers to discover credentials or privileged data. The attacker would need network access to the device and ability to provide crafted input to the vulnerable interface.