Siemens SIMATIC S7 Webserver API
Plan PatchCVSS 7.5ICS-CERT ICSA-26-295-10Oct 13, 2026
Siemens
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
.NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that could allow an attacker to obtain sensitive information or write arbitrary files outside the intended download directory. Siemens has released a new version for .NET Client Library for SIMATIC S7 Webserver API and recommends to update to the latest version.
What this means
What could happen
Could allow access to configuration files or firmware
Who's at risk
Organizations in critical infrastructure using Siemens equipment
How it could be exploited
Attacker on the corporate network or internet could reach this device without any credentials. The attack is straightforward with no special conditions
Exploitability
Unlikely to be exploited - EPSS score 0.4%
Affected products (2)
2 with fix
Remediation & Mitigation
0/2
Schedule - requires maintenance window
0/2Patching may require device reboot, plan for process interruption
UPGRADEUpdate to V3.3.61 or later version
UPGRADEUpdate to V3.3.62 or later version
CVEs (2)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/135a3f37-cb22-4152-b0f3-70c597a5a681Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.