CVE-2026-85115

Executive Summary

CVE-2026-85115 is a cleartext-credential exposure vulnerability in the .NET Client Library for the SIMATIC S7 Webserver API (all versions prior to V3.3.62). Affected applications fail to properly redact PLC restore passwords from HTTP error exception messages, causing plaintext restore credentials to be written into logs or other diagnostic output. An attacker with local access to those logs or diagnostics can recover the plaintext PLC restore password and use it to perform unauthorized restore/configuration operations on the PLC, with a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Technical Analysis

The core weakness is CWE-209, Generation of Error Message Containing Sensitive Information. The .NET Client Library for the SIMATIC S7 Webserver API is the client-side integration component used by applications to communicate with the SIMATIC S7 webserver API. When an HTTP request fails and the library raises an HTTP error exception, the resulting exception message is supposed to have the PLC restore password redacted before it is emitted. The affected versions do not perform that redaction correctly, so the plaintext restore password remains embedded in the exception message text.

Because the credential is exposed through an exception message rather than through a network protocol flaw or an authentication bypass, the disclosure channel is any place that exception message is persisted or surfaced. That includes application log files, centralized log aggregation pipelines, crash/error dumps, diagnostic bundles, and console or debug output. The vulnerability does not require the attacker to interact with the vulnerable application in real time; it only requires read access to the channel where the exception text has been retained.

The CVSS vector confirms the access model. AV:L (Local) indicates the attacker must already have some local access to the host or the log/diagnostic data, and AC:L (Attack Complexity: Low) indicates no special timing or race condition is required. PR:L (Privileges Required: Low) indicates only low-level privileges are needed to reach the affected logs or diagnostic output. UI:N (User Interaction: None) and S:U (Scope: Unchanged). The only impacted CIA component is Confidentiality at High (C:H), reflecting the direct exposure of a reusable plaintext credential. Integrity and Availability are recorded as None in the CVSS vector, although the downstream PLC operations enabled by the recovered password can themselves be destructive — the vector measures the immediate impact of this disclosure, not the consequences of subsequent authorized-by-credential operations.

Because the vulnerability is strictly an improper-redaction defect in client-side error handling, no specific URL endpoint, API path, function name, or class name is disclosed in the NVD description. No public PoC, exploit code, or Nuclei template exists for this CVE, and no technical detail beyond the description above is available; any claim about a specific internal method or request format would be fabrication. The attack must therefore be understood at the vulnerability-class level: sensitive data in error/exception output, exposed to anyone with read access to that output.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-209) and the NVD description. It deliberately avoids inventing function names, endpoints, or parameters not present in the source description.

1. Reconnaissance / target identification. The attacker identifies a host on which an application using the affected .NET Client Library (< V3.3.62) runs, and identifies the locations where that application's HTTP error exception messages are stored or displayed. This is a positioning step: the attacker needs existing access to logs, centralized log storage, diagnostic bundles, or console/debug output from an application that has communicated with the SIMATIC S7 webserver API.

2. Triggering the flaw class. The flaw is triggered when the library raises an HTTP error exception for a request and that exception message is emitted without the restore password being redacted. In practice, the credential has already been exposed the first time an affected application hit an HTTP error condition on a request that carried the restore password. The attacker does not need to cause the failure if a prior failure has already been logged; the attacker simply needs to locate the resulting exception text.

3. Extraction method at the vulnerability-class level. The attacker reads the relevant log file, log aggregation system, diagnostic archive, or debug output and searches for the restore password embedded in HTTP error exception messages. Because the description states the value appears in plaintext, no decoding, brute force, or cryptographic work is required; discovery is a search/parsing task over the log or diagnostic channel.

4. Post-exploitation impact. With the plaintext PLC restore password recovered, the attacker can perform unauthorized restore and configuration operations against the SIMATIC S7 PLC, as stated in the NVD description. Such operations can overwrite logic, alter configuration, or restore a state chosen by the attacker, which may disrupt or subvert the physical process controlled by the PLC. Because the credential is a legitimate restore password rather than a vulnerability exploit, subsequent activity on the PLC may appear as an authorized operation.

Detection and defense therefore focus on (a) preventing the credential from being written to logs and diagnostics in the first place, (b) controlling access to and retention of logs and diagnostic output, and (c) alerting on access to sensitive diagnostic channels and on anomalous restore/configuration activity on the PLC.

Impact Assessment

The primary business impact is credential compromise leading to unauthorized control-plane operations on industrial equipment. The CVSS v3.1 base score is 5.5 (Medium). The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N means:

• AV:L — the disclosure requires local access to logs or diagnostic output, not remote network access.
• AC:L — exploitation is straightforward once the attacker can read the affected data.
• PR:L — only low privileges are needed on the host or log platform.
• UI:N — no user interaction is required.
• S:U — impact is confined to the vulnerable component/security authority.
• C:H — the confidentiality impact is rated High, matching direct exposure of a reusable plaintext credential.
• I:N / A:N — no direct integrity or availability impact is measured for the disclosure event itself.

Blast radius is concentrated in OT/ICS environments that use the .NET Client Library for the SIMATIC S7 Webserver API and that aggregate or retain error output. The credential recovered is specifically a PLC restore password, whose misuse can affect the integrity of PLC configuration and — depending on the process — its availability and safety. The exposure is not broadcast over the network by the library itself; it is an at-rest/at-log exposure that widens with every additional system that copies, stores, indexes, or shares the exception text (log collectors, SIEM, ticketing systems, backup archives, vendor support bundles). This makes the practical blast radius a function of log distribution and retention hygiene, not just the single vulnerable host. There is no evidence of CISA KEV listing, and no known exploit-in-the-wild evidence provided in the source data.

Detection Guidance

Sigma Rule

title: Potential SIMATIC S7 Webserver API Restore Password Disclosure via Error Exception Logging
id: 8f3c2a41-7d5e-4a9b-9c21-6b0d4e2f7a10
status: experimental
description: Detects application or library error output that appears to contain a PLC restore password emitted by the .NET Client Library for SIMATIC S7 Webserver API (< V3.3.62), indicating CWE-209 credential exposure in logs.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85115
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: application
  product: windows
  definition: Application or library logs containing HTTP exception messages from the SIMATIC S7 client library.
detection:
  selection_process:
    - Image|endswith: '.exe'
  selection_keywords:
    - 'HttpRequestException'
    - 'HttpException'
    - 'WebException'
    - 'SIMATIC'
    - 'S7'
  selection_password_context:
    - 'restore'
    - 'RestorePassword'
    - 'password'
  condition: selection_keywords and selection_password_context
falsepositives:
  - Legitimate diagnostic output where the password field is already redacted
  - Generic applications logging the words 'password' and 'S7' in unrelated contexts
level: medium
tags:
  - attack.t1552
  - cwe.209

YARA Rule

rule CVE_2026_85115_SIMATIC_S7_Restore_Password_In_Error
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects plaintext PLC restore password exposure in HTTP error exception output from the .NET Client Library for SIMATIC S7 Webserver API (< V3.3.62)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85115"
        cve = "CVE-2026-85115"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $lib1 = "SIMATIC S7 Webserver" ascii wide nocase
        $lib2 = "S7 Webserver API" ascii wide nocase
        $err1 = "HttpRequestException" ascii wide
        $err2 = "WebException" ascii wide
        $err3 = "HttpException" ascii wide
        $ctx1 = "restore password" ascii wide nocase
        $ctx2 = "restorePassword" ascii wide nocase
        $ctx3 = "password=" ascii wide nocase

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x504B0304 or filesize > 0) and
        (1 of ($lib*) or 1 of ($err*)) and
        1 of ($ctx*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85115 Possible SIMATIC S7 Restore Password Disclosure in HTTP Error Response"; flow:established,to_client; http.response_body; content:"restore"; nocase; content:"password"; nocase; distance:0; within:120; content:"SIMATIC"; nocase; pcre:"/(restore[^\r\n]{0,40}password|password[^\r\n]{0,40}restore)/i"; reference:cve,CVE-2026-85115; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85115; classtype:attempted-recon; sid:202685115; rev:1; metadata:service http, service simatic-s7;)

Elastic Detection

// Detects HTTP error exception messages from the SIMATIC S7 client library that may contain a plaintext restore password (CVE-2026-85115, CWE-209)
// Ingest application or library logs into an index pattern such as logs-* with a message-like field.
sequence by host.name
  [ any where
      (stringContains(message, "SIMATIC") or stringContains(message, "S7 Webserver")) and
      (stringContains(message, "HttpRequestException") or
       stringContains(message, "HttpException") or
       stringContains(message, "WebException")) and
      (stringContains(message, "restore") or stringContains(message, "RestorePassword"))
  ]
  [ any where
      (stringContains(message, "restore") or stringContains(message, "RestorePassword")) and
      (stringContains(message, "password") or stringContains(message, "Password"))
  ]

Splunk SPL Query

index=app_logs OR index=windows_eventlog OR index=main
("SIMATIC" OR "S7 Webserver") ("HttpRequestException" OR "HttpException" OR "WebException" OR "Http error")
("restore password" OR "RestorePassword" OR "restore_password" OR ("restore" "password"))
| eval sensitive = if(match(_raw, "(?i)(restore[_\\- ]?password\\s*[:=]\\s*\\S+)"), "RESTORE_PWD_IN_LOG", "REVIEW")
| stats count min(_time) as first_seen max(_time) as last_seen values(host) as hosts values(source) as sources values(sensitive) as classification by index
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="simatic_s7,cve_2026_85115,credential_exposure,">
  <rule id="202685115" level="10">
    <decoded_as>json</decoded_as>
    <field name="message">HttpRequestException|HttpException|WebException</field>
    <match>S7 Webserver|SIMATIC</match>
    <match>restore|RestorePassword|password</match>
    <description>CVE-2026-85115: Possible plaintext PLC restore password exposed in SIMATIC S7 client library HTTP error exception output (CWE-209)</description>
    <mitre>
      <id>T1552</id>
    </mitre>
    <group>cwe_209,ics,credential_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Treat any log, diagnostic bundle, SIEM index, or support archive produced by an application using the affected .NET Client Library as potentially credential-bearing; restrict read access to the smallest possible set of personnel and systems.
• Reduce and expire retention of error/exception output from affected applications, and scrub or delete previously captured copies where feasible.
• Where possible, prevent the restore password from flowing into exception context (for example, by handling and sanitizing errors at the application layer before logging), so the plaintext value never reaches the emission point. Validate this against the actual library behavior rather than assuming redaction occurs.
• If the restore password may already have been logged, rotate the PLC restore password and review PLC configuration/logic for unauthorized restore or modification.
• Segment and monitor access to hosts and log platforms that process SIMATIC S7-related diagnostic output.

2. Patch/upgrade steps

• The advisory text references version V3.3.62 as the fixed version line for the .NET Client Library for SIMATIC S7 Webserver API, but no patch evidence is available from the tracked sources (patch confidence 0/4). Verify the fixed release directly with Siemens before relying on it.
• Track the incoming vendor advisory and CVE record for CVE-2026-85115, and apply the corrected library version as soon as it is confirmed available and validated in a test environment.
• After upgrading, confirm that HTTP error exception messages no longer contain the restore password by exercising controlled error paths and inspecting the output.

3. Long-term hardening

• Adopt a strict "never log secrets" policy with automated secret-scanning of log pipelines and diagnostic bundles, including CI/CD checks for sensitive fields in error output.
• Remove hardcoded or embedded credentials from client applications; use dedicated credential management with rotation.
• Apply least privilege to log and diagnostic platforms and monitor for unusual access to them.
• Harden the PLC side: enforce strong, unique restore credentials, restrict which systems may perform restore/configuration operations, and alert on unexpected restore activity.

References

• NVD — CVE-2026-85115: https://nvd.nist.gov/vuln/detail/CVE-2026-85115
• CWE-209, Generation of Error Message Containing Sensitive Information: https://cwe.mitre.org/data/definitions/209.html
• Siemens ProductCERT / Siemens Security Advisories (SSA) portal — consult for the authoritative advisory and fixed version confirmation corresponding to CVE-2026-85115: https://www.siemens.com/cert
• MITRE ATT&CK T1552, Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
• CISA Known Exploited Vulnerabilities Catalog (status check — CVE-2026-85115 is NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence were identified in the source data for CVE-2026-85115.