Siemens has disclosed two vulnerabilities in its .NET Client Library for the SIMATIC S7 Webserver API, affecting industrial deployments across multiple critical infrastructure sectors worldwide, including critical manufacturing, transportation, energy, healthcare, and financial services.

What’s affected

The flaws impact all versions of the .NET Client Library for SIMATIC S7 Webserver API prior to V3.3.61 and V3.3.62, depending on the specific CVE. Siemens, headquartered in Germany, has released updated versions that address both issues and is urging customers to update immediately.

The vulnerabilities

  • CVE-2026-85114 (CVSS 3.1 score: 7.5, High): Affected applications fail to properly validate filenames received from remote servers during ticket downloads. An attacker able to manipulate the ticket response could write arbitrary files outside the intended download directory, and if file overwriting is enabled, could replace existing files accessible to the application. This is classified as a path traversal vulnerability (CWE-22). The fix is available in V3.3.61 or later.
  • CVE-2026-85115 (CVSS 3.1 score: 5.5, Medium): Affected applications do not properly redact PLC restore passwords from HTTP error exception messages. An attacker with access to logs or other diagnostic output could recover the plaintext restore password and use it to perform unauthorized operations on the PLC. This is classified as generation of an error message containing sensitive information (CWE-209). The fix is available in V3.3.62 or later.

Both vulnerabilities were reported to CISA by Siemens ProductCERT, which tracks the issue internally as SSA-390352.

Recommendations

Siemens recommends updating to the latest library version as the primary remediation. CISA and Siemens also advise standard industrial control system hardening measures: minimizing network exposure for control system devices, ensuring they are not reachable from the internet, placing control system networks behind firewalls and isolated from business networks, and using VPNs for remote access while keeping VPN software current.

Organizations should also follow Siemens’ operational guidelines for industrial security and perform proper risk assessment before deploying any defensive measures or configuration changes in production environments.