A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61).
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received from remote servers during ticket downloads. This could allow an attacker who can manipulate the ticket response to write arbitrary files outside the intended download directory and, when overwriting is enabled, replace existing files accessible to the application.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Siemens
- Product
- SIMATIC / RUGGEDCOM / SINEC / SCALANCE / WinCC / TIA Portal
- CVSS
- 7.5
- EPSS
- 0.003 (p26)
- Exposure class
- OT / ICS
Why it ranks 21 (Routine)
- CVSS 7.5 high
- Product class: OT / ICS
- Covered by 2 independent sources
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-85114 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.