Full Report
.NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that could allow an attacker to obtain sensitive information or write arbitrary files outside the intended download directory. Siemens has released a new version for .NET Client Library for SIMATIC S7 Webserver API and recommends to update to the latest version.
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in .NET Client Library for SIMATIC S7 Webserver API
## CVE Details
- **CVE ID:** CVE-2026-85114
- **CVSS Score:** 7.5 (High) / CVSS v4.0: 8.7 (High)
- **CWE:** CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- **CVE ID:** CVE-2026-85115
- **CVSS Score:** 5.5 (Medium) / CVSS v4.0: 6.8 (Medium)
- **CWE:** CWE-209: Generation of Error Message Containing Sensitive Information
## Affected Systems
- **Products:** .NET Client Library for SIMATIC S7 Webserver API
- **Versions:**
- All versions < V3.3.61 (Affected by CVE-2026-85114)
- All versions < V3.3.62 (Affected by CVE-2026-85115)
- **Configurations:** Applications utilizing the library to handle ticket downloads or PLC restore functions.
## Vulnerability Description
- **CVE-2026-85114 (Path Traversal):** The library fails to properly validate filenames provided by remote servers during the ticket download process. An attacker capable of manipulating the ticket response can inject path traversal sequences (e.g., `../../`) to write arbitrary files outside the designated download directory. If the application has sufficient permissions and overwriting is enabled, this could lead to the replacement of critical system or application files.
- **CVE-2026-85115 (Information Exposure):** The library does not redact PLC restore passwords when generating HTTP error exception messages. If an error occurs during a restore operation, the plaintext password may be leaked into application logs, consoles, or diagnostic traces.
## Exploitation
- **Status:** Not reported as exploited in the wild; No PoC currently available in the public domain.
- **Complexity:** Low
- **Attack Vector:**
- **CVE-2026-85114:** Network (Remote)
- **CVE-2026-85115:** Local (Requires access to logs/diagnostic output)
## Impact
- **Confidentiality:** High (CVE-2026-85115 - Exposure of PLC passwords)
- **Integrity:** High (CVE-2026-85114 - Arbitrary file write/overwrite)
- **Availability:** None reported (though file overwrites can lead to indirect DoS)
## Remediation
### Patches
Siemens recommends updating to the following versions:
- **V3.3.61 or later:** Fixes CVE-2026-85114.
- **V3.3.62 or later:** Fixes CVE-2026-85115.
Download Link: hxxps[://]github[.]com/siemens/simatic-s7-webserver-api/releases
### Workarounds
- **General Mitigation:** Restrict network access to the S7 Webserver API to trusted hosts only.
- **Log Security:** For CVE-2026-85115, ensure that application logs and error outputs are protected by strict access control lists (ACLs) to prevent unauthorized viewing of plaintext passwords.
- **Permissions:** Run the client application with the least privilege necessary to minimize the impact of an arbitrary file write.
## Detection
- **Indicators of Compromise:** Review server/client logs for unusual file paths in ticket download requests or unexpected file creation events in system directories.
- **Audit:** Check existing log files for the presence of plaintext PLC restore passwords in HTTP exception strings.
## References
- **Vendor Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/html/ssa-390352[.]html
- **Siemens Industrial Security Guidelines:** hxxps[://]www[.]siemens[.]com/cert/operational-guidelines-industrial-security
- **Siemens ProductCERT:** hxxps[://]www[.]siemens[.]com/cert/advisories