MEDIUM CWE-209
CVE-2026-85115
Siemens .NET Client Library for SIMATIC S7 Webserver API vulnerability
Siemens·.NET Client Library for SIMATIC S7 Webserver API
5.5/ 10
CVSS 3.1
Medium severity
0.11%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 1% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list.
Timeline
- Published
- Oct 13, 2026
- Updated
- Oct 14, 2026
- First covered
- Oct 26, 2026
- Latest story
- 3 weeks ago
Summary
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affected applications do not properly redact PLC restore passwords from HTTP error exception messages.This could allow an attacker with access to logs or other diagnostic output to obtain the plaintext restore password and potentially perform unauthorized operations on the PLC.
CWE-209Generation of Error Message Containing Sensitive Information
Attack profile
Attack vectorLocal
ComplexityLow
PrivilegesLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NAffected products
- Siemens .NET Client Library for SIMATIC S7 Webserver APIbefore V3.3.62