Siemens S7 Web API Flaws Expose Critical Infrastructure to File Writes and Data Leaks

En bref

• CVE-2026-85114 and CVE-2026-85115 affect Siemens' S7 web server API and the .NET client library.
• Versions 3.3.61 and 3.3.62 are in scope.
• Attackers could use path traversal to write files outside intended locations and expose sensitive data.
• Error messages may reveal information useful to intruders.
• Siemens and CISA point to installing the newest release; critical infrastructure operators should prioritize review.

Two newly identified vulnerabilities, tracked as CVE-2026-85114 and CVE-2026-85115, affect Siemens' S7 web server programming interface and the companion .NET client library. The affected release range is 3.3.61 and 3.3.62, according to the facts provided. The disclosure names Siemens and CISA as vendors.

The weaknesses matter because they combine several risky behaviors: path traversal, the ability to write files beyond an intended directory, exposure of sensitive data, and leakage of information through error messages. In an operational technology setting, those issues can increase the chance that an intruder gains visibility or tampers with files on systems that support critical infrastructure sectors.

The severity is medium, but the affected products sit in environments where availability and integrity carry outsized importance. Critical infrastructure sectors are specifically in scope, so defenders should not wait for active exploitation reports before reviewing exposure. Attackers do not need a novel technique if a reachable service permits traversal or out-of-directory writes.

The remediation direction from the named vendors is to install the newest release. Operators should inventory instances at versions 3.3.61 and 3.3.62, check whether the .NET client library is bundled in dependent tooling, and watch for error-message leakage in logs. Because the flaws include information exposure and file-write behavior, monitoring for unexpected files and unusual API calls is warranted.

À faire maintenant

1. Inventory all Siemens S7 web server API and .NET client library deployments; flag versions 3.3.61 and 3.3.62.
2. Install the newest Siemens release for both components as soon as change control permits.
3. Restrict network access to the S7 web interface and client-library endpoints to trusted management zones.
4. Review logs for path traversal attempts, writes outside expected directories, and error messages that reveal system details.
5. Harden error handling and disable verbose error output where supported, then test.
6. Monitor file integrity in directories adjacent to application write paths and alert on unexpected creations.
7. Track CVE-2026-85114 and CVE-2026-85115 for vendor updates and validate compensating controls until patched.

Références CVE

• CVE-2026-85114
• CVE-2026-85115

Source originale

CISA Advisories