.NET Client Library CVE-2026-85114

Exploitation requires the attacker to control or man-in-the-middle the remote server from which the .NET client performs a ticket download, so that the attacker can supply a crafted filename in the ticket response - the client does not validate this filename before writing. The arbitrary-file-WRITE outside the download directory occurs on any affected version; the additional ability to REPLACE existing files is limited to deployments where the application has file overwriting enabled. Key limiting factors: the vulnerable component is a client library (not a listening service), so the attacker must already sit in the server/MITM position relative to the victim client, and the file-overwrite escalation depends on the non-default overwrite setting.

This is a CWE-22 path traversal in a Siemens-published .NET client library (all versions < V3.3.61) that improperly validates filenames returned by a remote server during ticket downloads, enabling arbitrary file write outside the intended directory. Siemens' CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) scores it 8.7 (High) with impact concentrated entirely on integrity (VI:H; VC:N/VA:N) - consistent with a file-write primitive that could overwrite application-accessible files and plausibly lead to code execution, though the advisory does not claim RCE. A critical nuance the raw vector obscures: this is a CLIENT library, so exploitation requires an attacker who already controls or can MITM the server the client connects to ('an attacker who can manipulate the ticket response'). This is not a classic server-side remote-unauthenticated bug against a listening service, despite the AV:N/PR:N framing. No EPSS score, CISA KEV listing, or public POC is present in the provided data - so there is no evidence of active or imminent exploitation. Net assessment: a genuinely serious flaw for environments where the library connects to untrusted or MITM-able S7 webserver endpoints, but real-world urgency is tempered by the niche OT deployment footprint and the server-control precondition. Prioritize patching to V3.3.61 for affected integrations, but this is not a drop-everything internet-wide threat.

An attacker who controls a malicious or compromised SIMATIC S7 webserver (or who can man-in-the-middle the connection) returns a ticket-download response containing a crafted filename with directory-traversal sequences. The vulnerable .NET client writes the downloaded content to an attacker-chosen path outside the intended download directory, and where overwriting is enabled, replaces an existing file the application can access - potentially a binary or config leveraged for code execution. No public exploit code is identified at time of analysis.