CVE-2026-85115
5.5MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-209
Impact
Attackers with local access to logs or diagnostic outputs can extract plaintext PLC restore passwords and perform unauthorized operations on the PLC. They need existing read access to the application logs or error streams to see the credentials.
Root cause
The client library fails to redact PLC restore passwords from HTTP error exception messages.
Affected systems
.NET Client Library for SIMATIC S7 Webserver API versions prior to V3.3.62
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Upgrade .NET Client Library for SIMATIC S7 Webserver API to version V3.3.62 or later. If patching immediately is not possible, restrict access to application logs and suppress detailed exception outputs in production environments.
$ dotnet add package Siemens.Simatic.S7.Webserver.API --version 3.3.62AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affected applications do not properly redact PLC restore passwords from HTTP error exception messages. This could allow an attacker with access to logs or other diagnostic output to obtain the plaintext restore password and potentially perform unauthorized operations on the PLC.