Insufficient Password Redaction in SIMATIC S7 Webserver API by Siemens
CVE-2026-85115

6.8MEDIUM

Key Information:

Vendor

Siemens
Status
.net Client Library For Simatic S7 Webserver Api
Vendor
CVE Published:
13 October 2026

What is CVE-2026-85115?

A vulnerability has been identified in the .NET Client Library for the SIMATIC S7 Webserver API, affecting all versions prior to V3.3.62. The issue arises from the improper redaction of PLC restore passwords in HTTP error exception messages. Consequently, an attacker with access to logs or diagnostic outputs could potentially extract the plaintext restore password, enabling unauthorized operations on the Programmable Logic Controller (PLC). It is essential for users of this API to upgrade to the latest version to mitigate this risk.

Affected Version(s)

.NET Client Library for SIMATIC S7 Webserver API 0

References

https://cert-portal.siemens.com/productcert/html/ssa-3903...

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.