Siemens Releases Patches for Two Vulnerabilities in .NET Client Library for SIMATIC S7 Webserver API

Siemens ProductCERT, in coordination with the Cybersecurity and Infrastructure Security Agency (CISA), has issued advisories regarding two vulnerabilities affecting the .NET Client Library for SIMATIC S7 Webserver API. The library is used for communication between SIMATIC controllers and client applications in industrial automation environments.

CVE-2026-85114 has a CVSS 3.1 base score of 7.5 (HIGH). It stems from improper validation of filenames received from remote servers during ticket downloads. An attacker who can manipulate the ticket response could write arbitrary files outside the intended download directory. If file overwriting is enabled, this could result in replacement of existing files accessible to the application.

CVE-2026-85115 has a CVSS 3.1 base score of 5.5 (MEDIUM). It involves insufficient redaction of PLC restore passwords from HTTP error exception messages. An attacker with access to logs or diagnostic output could obtain the plaintext restore password, potentially enabling unauthorized operations on the programmable logic controller (PLC).

Siemens has released updated versions of the .NET Client Library: v3.3.61 addresses CVE-2026-85114, and v3.3.62 addresses CVE-2026-85115. The vendor strongly recommends updating to the latest version. Additionally, Siemens advises protecting network access to control system devices, locating industrial networks behind firewalls, and using VPNs for remote access where required.

CISA recommends minimizing network exposure for all control system devices, ensuring they are not internet-accessible, and isolating control system networks from business networks. Organizations are advised to perform impact analysis and risk assessment prior to deploying defensive measures.