Siemens SIMATIC S7 .NET Client Library flaws patched
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
Siemens patched path traversal and information disclosure bugs in its .NET Client Library for SIMATIC S7 Webserver API; update to version 3.3.62 or later.
Siemens disclosed two vulnerabilities in the .NET Client Library for SIMATIC S7 Webserver API affecting versions prior to 3.3.62. The first is a path traversal flaw (CWE-22) that could allow an attacker to write arbitrary files outside the intended download directory. The second involves generation of error messages containing sensitive information, which could expose data to an attacker. Both vulnerabilities carry a CVSS v3 score of 7.5.
The library is used across industries deploying SIMATIC S7 controllers, with CISA noting deployment worldwide across Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, and Government Services sectors. Siemens ProductCERT reported these issues to CISA, and no evidence of active exploitation is mentioned in the advisory. Siemens has released an updated version (3.3.62) and recommends all users update immediately. CISA republished the Siemens advisory (SSA-390352) and reiterates standard ICS hardening guidance: minimizing network exposure, isolating control system networks behind firewalls, and using secure remote access methods such as VPNs when necessary.
This is a vendor-patched vulnerability disclosure with no reported in-the-wild exploitation. Defenders using this client library should prioritize patching to version 3.3.62 or later and review network segmentation for SIMATIC S7 deployments.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-10
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,989 reports from 143 sources, 543 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs