Siemens SIMATIC S7 Webserver API vulnerabilities
NET Client Library for SIMATIC S7 Webserver API versions before 3.3.61 and 3.3.62 vulnerable to path traversal and sensitive information exposure; update to 3.3.61 or later.
55
CVE-2026-85114
Path traversal in Siemens .NET SIMATIC S7 Webserver client
- CVSS 4.0
- 8.7 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
The Siemens .NET Client Library for SIMATIC S7 Webserver API (all versions before V3.3.61) does not properly validate filenames returned by a remote server when downloading tickets, a path-traversal flaw (CWE-22). An attacker who can manipulate that ticket response—for example a malicious or compromised web server, or a man-in-the-middle—can cause the client application to write files outside the intended download directory and, if overwrite is enabled, replace existing files the application can access. Impact is high integrity on the client host (CVSS 4.0 8.7); confidentiality and availability are not scored as affected. Only applications built with this library are in scope, not SIMATIC S7 controllers by themselves. It is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Upgrade the .NET Client Library for SIMATIC S7 Webserver API to V3.3.61 or later. Until then, use the library only against trusted S7 web servers, prefer TLS with certificate validation so ticket responses cannot be altered in transit, and disable download overwrite where the application allows it. Review the download directory and any files the process can write for unexpected or overwritten content.
| Product | Affected |
|---|---|
| Siemens .NET Client Library for SIMATIC S7 Webserver API | All versions < V3.3.61 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received from remote servers during ticket downloads. This could allow an attacker who can manipulate the ticket response to write arbitrary files outside the intended download directory and, when overwriting is enabled, replace existing files accessible to the application.
- Weakness
- CWE-22
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X