Path Traversal and Sensitive Info Leak in Siemens SIMATIC S7 Webserver API .NET Client Library (CVE‑2026‑85114, CVE‑2026‑85115)
What It Is – The .NET client library for Siemens SIMATIC S7 Webserver API (versions < 3.3.61 and < 3.3.62) contains two high‑severity flaws: a path‑traversal issue that lets an attacker write files outside the intended download directory, and an error‑message disclosure that reveals sensitive information.
Exploitability – Both vulnerabilities have a CVSS v3 base score of 7.5 (High). No public exploit code is known, but the flaws are trivial to trigger by manipulating the ticket response from a compromised server.
Affected Products – Siemens SIMATIC S7 Webserver API .NET Client Library (all releases prior to 3.3.61/3.3.62).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous monitoring of third‑party component versions against secure‑configuration controls.
- Highlights gaps in file‑system access controls that must be evidenced for audit readiness across multiple frameworks.
- Provides a concrete example of why a defensible evidence trail (patch status, version inventory) is a prerequisite for enterprise‑level trust.
Recommended Actions
- Upgrade immediately to the Siemens‑released version ≥ 3.3.62.
- Validate all inbound filenames against a whitelist and enforce strict path canonicalization.
- Enable file‑integrity monitoring and log any unexpected writes outside the download directory.
- Incorporate the library’s version into your continuous component‑risk inventory and map the remediation to the “secure configuration” control objective.
Source: CISA Advisory – ICSA‑26‑295‑10