Net Client Library For Simatic S7 Webserver Api
Monthly
Path traversal in the Siemens .NET Client Library for the SIMATIC S7 Webserver API (all versions prior to V3.3.61) lets a remote attacker who controls or man-in-the-middles the server that the client downloads tickets from specify a crafted filename and thereby write arbitrary files outside the intended download directory. Integrity impact is high (VI:H) while confidentiality and availability impacts are none, consistent with the vendor's CVSS 4.0 base score of 8.7; the CVSS vector indicates no privileges (PR:N) or user interaction (UI:N) are required, so the only real prerequisite is that the attacker already occupies the server/MITM position relative to the victim client. The additional ability to replace existing files is limited to deployments where file overwriting is enabled. No public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation.
The .NET Client Library for SIMATIC S7 Webserver API (all versions before V3.3.62) fails to redact PLC restore passwords from HTTP error exception messages, causing plaintext credentials to be written into logs and diagnostic output. An authenticated attacker with low-privileged local access to those logs (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base score 5.5) can recover the restore password and, if it is still valid, use it to perform unauthorized restore or configuration operations against the corresponding SIMATIC S7 PLC. Exploitation is conditional: the vulnerable library must have handled a restore operation that produced an HTTP error, and the resulting diagnostic artifact must be readable by the attacker. No public exploit code has been identified at time of analysis and this CVE has not been confirmed actively exploited (CISA KEV); Siemens has released a fix in V3.3.62.
Path traversal in the Siemens .NET Client Library for the SIMATIC S7 Webserver API (all versions prior to V3.3.61) lets a remote attacker who controls or man-in-the-middles the server that the client downloads tickets from specify a crafted filename and thereby write arbitrary files outside the intended download directory. Integrity impact is high (VI:H) while confidentiality and availability impacts are none, consistent with the vendor's CVSS 4.0 base score of 8.7; the CVSS vector indicates no privileges (PR:N) or user interaction (UI:N) are required, so the only real prerequisite is that the attacker already occupies the server/MITM position relative to the victim client. The additional ability to replace existing files is limited to deployments where file overwriting is enabled. No public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation.
The .NET Client Library for SIMATIC S7 Webserver API (all versions before V3.3.62) fails to redact PLC restore passwords from HTTP error exception messages, causing plaintext credentials to be written into logs and diagnostic output. An authenticated attacker with low-privileged local access to those logs (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base score 5.5) can recover the restore password and, if it is still valid, use it to perform unauthorized restore or configuration operations against the corresponding SIMATIC S7 PLC. Exploitation is conditional: the vulnerable library must have handled a restore operation that produced an HTTP error, and the resulting diagnostic artifact must be readable by the attacker. No public exploit code has been identified at time of analysis and this CVE has not been confirmed actively exploited (CISA KEV); Siemens has released a fix in V3.3.62.