CVE-2026-85115CWE-209

CVE-2026-85115

Medium · published October 13, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
4.0
In the wild
Unconfirmed
What it is

A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affected applications do not properly redact PLC restore passwords from HTTP error exception messages.

This could allow an attacker with access to logs or other diagnostic output to obtain the plaintext restore password and potentially perform unauthorized operations on the PLC.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
6.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00151 · 4.0th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2026-10-13T14:17Z
References (1)
https://cert-portal.siemens.com/productcert/html/ssa-390352.html · [email protected]
EPSS history
Timeline
  • 15 OCT 03:34Z
    EPSS moved — → 0%
    epss
  • 13 OCT 09:18Z
    A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62)
    cvelistv5
  • 13 OCT 09:18Z
    A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62)
    cvelistv5