CVE-2026-85115: CWE-209: Generation of Error Message Containing Sensitive Information in Siemens .NET Client Library for SIMATIC S7 Webserver API

The vulnerability CVE-2026-85115 affects all versions of the Siemens .NET Client Library for SIMATIC S7 Webserver API before version 3.3.62. It is classified under CWE-209, which relates to the generation of error messages containing sensitive information. Specifically, affected applications do not properly redact PLC restore passwords from HTTP error exception messages. This flaw could lead to disclosure of plaintext restore passwords if an attacker can access logs or diagnostic outputs containing these error messages.

An attacker with access to logs or diagnostic outputs that include HTTP error exception messages could obtain the plaintext PLC restore password. This exposure could enable unauthorized operations on the PLC, compromising confidentiality and potentially control over the device. The CVSS v3.1 base score is 5.5 (medium severity), reflecting local attack vector with low complexity and low privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.

A fix is available in Siemens .NET Client Library for SIMATIC S7 Webserver API version 3.3.62 and later. Users should upgrade to version 3.3.62 or above to remediate this vulnerability. No cloud service is involved, so remediation depends on applying the vendor patch. Patch status is confirmed by the affectedVersions data indicating versions before 3.3.62 are vulnerable.