Siemens SIMATIC S7 Webserver API Vulnerabilities Allow File Writes and Password Leaks
Two vulnerabilities in Siemens' SIMATIC S7 Webserver API .NET Client Library could permit attackers to write arbitrary files or expose PLC restore passwords.
Siemens has issued a security advisory detailing two critical vulnerabilities affecting its SIMATIC S7 Webserver API .NET Client Library. These flaws, identified as CVE-2026-85114 and CVE-2026-85115, could allow unauthorized actors to gain elevated privileges and compromise sensitive industrial control system (ICS) data.
The first vulnerability, CVE-2026-85114, is a path traversal flaw with a CVSS score of 7.5. This vulnerability arises because the affected applications do not adequately validate filenames received from remote servers during ticket downloads. An attacker who can manipulate these responses could potentially write arbitrary files to locations outside the intended download directory. If file overwriting is enabled on the target system, this could lead to the replacement of existing, critical files accessible by the application, potentially disrupting operations or enabling further compromise.
Siemens recommends updating the .NET Client Library for SIMATIC S7 Webserver API to version V3.3.61 or later to mitigate CVE-2026-85114. This fix addresses the improper limitation of a pathname to a restricted directory, a common weakness that can have severe consequences in industrial environments where system integrity is paramount.
The second vulnerability, CVE-2026-85115, carries a CVSS score of 5.5 and involves the generation of error messages containing sensitive information. Specifically, the affected applications fail to properly redact PLC restore passwords from HTTP error exception messages. This means that an attacker with access to system logs or other diagnostic outputs could potentially retrieve the plaintext restore password.
With this password, an attacker could perform unauthorized operations on the Programmable Logic Controller (PLC), potentially leading to system manipulation, data theft, or operational disruption. Siemens advises updating the .NET Client Library for SIMATIC S7 Webserver API to version V3.3.62 or later to address this information disclosure vulnerability.
These vulnerabilities impact a wide range of critical infrastructure sectors globally, including Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, and Government Services and Facilities. The widespread deployment of Siemens' SIMATIC S7 products underscores the potential impact of these flaws.
CISA, in conjunction with Siemens ProductCERT, is urging organizations to implement recommended security measures. These include minimizing network exposure for all control system devices, ensuring they are not accessible from the internet, and locating ICS networks behind firewalls. Secure remote access methods like VPNs, kept up-to-date, are also advised. Organizations are encouraged to perform thorough impact and risk assessments before deploying any defensive measures.
Siemens also provides operational guidelines for Industrial Security, emphasizing the importance of protecting network access to devices and configuring environments according to best practices. The company's commitment to security is highlighted by its proactive reporting of these vulnerabilities to CISA, enabling a coordinated response to protect industrial control systems worldwide.