cyfenced.com →

[ CVE-2026-85115 · Published 13 Oct 2026 ]

Vulnerability in Siemens .NET Client Library for SIMATIC S7 Webserver API

CVSS 5.5 EPSS <1%3 agency advisoriesNo fix listed yet

[ Description ]Official description

A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affected applications do not properly redact PLC restore passwords from HTTP error exception messages. This could allow an attacker with access to logs or other diagnostic output to obtain the plaintext restore password and potentially perform unauthorized operations on the PLC.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

  • NCSC-NLNCSC-2026-0415

    Vulnerabilities fixed in Siemens products Translated from Dutch

    Probability/damage M/HCVE-2024-7322CVE-2025-6965CVE-2025-70873+38 more CVEs
  • CERT-FRCERTFR-2026-AVI-1298

    Multiple vulnerabilities in Siemens products Translated from French

    Multiple vulnerabilities have been discovered in Siemens products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

    CVE-2021-41617CVE-2023-28531CVE-2023-51384+716 more CVEs
  • BSI CERT-BundWID-SEC-2026-3891

    Siemens SIMATIC S7: Multiple vulnerabilities Translated from German

    CVE-2026-46331CVE-2024-49998CVE-2025-21779+384 more CVEs

[ References ]References