CVE-2026-85115 in .NET Client Library for SIMATIC S7 Webserver API
Summary
by MITRE • 10/13/2026
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affected applications do not properly redact PLC restore passwords from HTTP error exception messages.
This could allow an attacker with access to logs or other diagnostic output to obtain the plaintext restore password and potentially perform unauthorized operations on the PLC.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The identified vulnerability resides within the .NET Client Library for the SIMATIC S7 Webserver API, specifically affecting all versions prior to V3.3.62. This library serves as a critical interface for applications interacting with Siemens SIMATIC Programmable Logic Controllers via HTTP-based web services. The core technical flaw is an improper handling of sensitive credentials during error processing routines. When the application encounters an exception while attempting operations that require authentication, such as restoring configuration data or accessing protected resources, the underlying code fails to sanitize the output stream before logging or displaying the error message. Consequently, if a restore operation fails due to incorrect credentials or other issues, the HTTP error response containing the plaintext password is inadvertently included in standard diagnostic outputs, application logs, or console traces. This represents a classic case of sensitive information exposure through improper log sanitization mechanisms.
From an operational perspective, this vulnerability poses a severe risk to industrial control systems that rely on these PLCs for critical infrastructure management. An attacker who gains access to system logs, whether through local file system compromise, remote logging server interception, or even via network packet capture if the diagnostic output is transmitted over unencrypted channels, can extract the plaintext restore password. The ability to obtain this credential allows the adversary to bypass authentication controls entirely during restoration procedures. This capability enables unauthorized configuration changes, potential disruption of industrial processes, and further lateral movement within the OT environment. Since PLCs often control physical machinery or safety systems, such unauthorized access could lead to significant operational downtime, equipment damage, or even threats to personnel safety depending on the specific application context.
This vulnerability aligns with CWE-532, which defines information exposure through log files, and CWE-798, concerning the use of hardcoded credentials if those passwords were also statically defined in code rather than just exposed via logs. In terms of offensive security frameworks, this flaw facilitates techniques associated with MITRE ATT&CK ID T1078, specifically Valid Accounts, as it allows an attacker to leverage legitimate but compromised credentials for unauthorized access. Furthermore, the exploitation vector relates to T1530, Data from Local System, where the adversary retrieves data directly from storage or local system logs without needing complex exfiltration techniques beyond simple log reading permissions.
Mitigation strategies must focus on both immediate remediation and long-term secure coding practices. The primary solution is to upgrade the .NET Client Library for SIMATIC S7 Webserver API to version V3.3.62 or later, where this sanitization issue has been addressed by developers. For environments unable to immediately patch due to compatibility constraints, defensive measures should include implementing strict log filtering rules that mask password fields using regular expressions before writing them to any persistent storage or console output. Additionally, organizations should enforce the principle of least privilege for service accounts and ensure that diagnostic logging levels are appropriately configured in production environments to minimize verbose error reporting. Regular audits of log files and implementation of SIEM solutions capable of detecting patterns indicative of credential exposure can also help identify potential exploitation attempts early.