.NET Client Library CVE-2026-85115

Exploitation requires that the vulnerable .NET Client Library (all versions below V3.3.62) has actually handled a PLC restore operation that produced an HTTP error/exception, AND that the attacker can read the resulting logs, exception traces, or diagnostic output where the restore password is written in plaintext. Limiting factors: the attacker needs pre-existing low-privilege local access to those logs or diagnostic artifacts (PR:L, AV:L) - the flaw does not grant that access; a restore workflow must have been exercised and failed/errored to generate the message; and the leaked secret is useful only against the corresponding SIMATIC S7 PLC. There is no user interaction requirement and no special PLC-side configuration beyond using the affected library version.

This is a moderate, defense-in-depth issue rather than a front-line priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a local, low-privilege information-disclosure flaw with high confidentiality impact but no integrity or availability impact - consistent with CWE-209 (Generation of Error Message Containing Sensitive Information). No EPSS score, CISA KEV listing, or public POC was supplied in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The real-world risk is bounded by the prerequisite that an attacker must already have access to logs or diagnostic output containing the leaked PLC restore password; the vulnerability does not itself grant that access, making it a privilege-escalation/secondary-exposure concern rather than a standalone remote threat. Note one tension to verify: the description frames the leak as appearing in 'HTTP error exception messages,' which could suggest a network-facing surface, yet the CVSS vector is AV:L - Siemens evidently scored the exploitation point as consumption of local logs/diagnostic output rather than over-the-wire interception, which is the more conservative and defensible reading given the client-library context.

An attacker or malicious insider with read access to application logs, crash dumps, or diagnostic output produced by software using the .NET Client Library locates an unredacted plaintext PLC restore password captured in an HTTP error/exception message. They reuse that password to authenticate to the SIMATIC S7 PLC and perform unauthorized restore or configuration operations. No public exploit code is required - the attack is simply reading an exposed secret from logs.