Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

Siemens SIMATIC S7 Webserver API vulnerabilities

Original title: Siemens SIMATIC S7 Webserver API

CISA Advisoriesby CISA ()3 min read1
Read at cisa.gov
Part of a story covered by 3 sourcesSiemens issues BIOS fixes for SIMATIC IPC Secure Boot bypassMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

NET Client Library for SIMATIC S7 Webserver API versions before 3.3.61 and 3.3.62 vulnerable to path traversal and sensitive information exposure; update to 3.3.61 or later.

NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that could allow an attacker to obtain sensitive information or write arbitrary files outside the intended download directory. CVE-2026-85114 allows manipulation of ticket responses to write arbitrary files. CVE-2026-85115 allows obtaining plaintext restore passwords from error messages. Siemens recommends updating to the latest version. CISA republished the advisory.

Key facts
  • Update to V3.3.61 or later for CVE-2026-85114
  • Update to V3.3.62 or later for CVE-2026-85115
  • Protect network access to devices
  • Follow Siemens industrial security guidelines
Security assessment · AI, from the article

Impact: obtain sensitive information or write arbitrary files outside intended directory

ProductAffectedFixed in
Siemens NET Client Library for SIMATIC S7 Webserver API< V3.3.61, < V3.3.62V3.3.61, V3.3.62
What to do
  1. 1.Update to V3.3.61 or later
  2. 2.Update to V3.3.62 or later
  3. 3.Protect network access to devices with appropriate mechanisms
Analyze CVE-2026-85114 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-85114CVE-2026-85115
Tags
siemenssimatics7webservercisaics
Vendors
Siemens
Products
NET Client Library for SIMATIC S7 Webserver API
Organizations
CISASiemens ProductCERT

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-85114
Path traversal in Siemens .NET SIMATIC S7 Webserver client
8.7—
CVE-2026-85115
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62)
6.8—

From the original article

3 min read at cisa.gov

View CSAF Summary . NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that could allow an attacker to obtain sensitive information or write arbitrary files outside the intended download directory. Siemens has released a new version for .

CISA Advisories

By CISA · cisa.gov

Read the full article at CISA Advisories

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.