Siemens .NET Client Library for SIMATIC S7 Webserver API: Path traversal in ticket download

Summary

The .NET Client Library for SIMATIC S7 Webserver API does not properly validate filenames received from remote servers during ticket downloads. An attacker who can manipulate the ticket response can write arbitrary files outside the intended download directory and, if overwriting is enabled, replace existing files accessible to the application. The attack requires the ability to manipulate the server response, for example via a man-in-the-middle position or a compromised server. The library is a developer component used in custom software, not in the PLC itself.

Affected

• Siemens .NET Client Library for SIMATIC S7 Webserver API (package Siemens.Simatic.S7.Webserver.API), all versions below V3.3.61
• Version scope of CVE-2026-85114 per the Siemens advisory: all versions below V3.3.61; the CISA list also shows a <3.3.62 entry that is attributed to both CVE-2026-85114 and CVE-2026-85115, so confirm with the Siemens advisory

Fixed in

• Update to V3.3.61 or later; V3.3.62 or later is recommended, as it covers both readings of the version scope

Workaround

• Unknown. No official interim mitigation is documented by Siemens.

Exploitation

• No evidence of exploitation in the wild found. Not listed in the CISA KEV catalog according to the sources checked.
• Siemens SSVC assessment (CISA record): Exploitation none, automatable yes, technical impact partial.
• No public proof of concept found in the searches performed; this does not prove that none exists.

Our recommendation

• Inventory all applications that reference the Siemens.Simatic.S7.Webserver.API package, including vendor and in-house tools.
• Update to V3.3.62 or later, then rebuild and redeploy the affected applications.
• Until patched, restrict ticket download sources to trusted, authenticated endpoints and run the application with least privilege using a dedicated download directory (own recommendation, not Siemens guidance).
• Monitor the Siemens advisory SSA-390352 and the CISA KEV catalog for changes.
• Priority: moderate for organisations running such software, low otherwise. A plain PLC web server is not affected by this library.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Siemens ProductCERT SSA-390352 cert-portal.siemens.com
• CISA ICS Advisory ICSA-26-295-10 www.cisa.gov
• Siemens SIMATIC S7 Webserver API GitHub repository github.com
• CVE-2026-85114 at threatint cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:34.