The vulnerability in the Siemens .NET Client Library for SIMATIC S7 Webserver API allows an attacker who can manipulate the ticket response to supply an arbitrary filename. Because the library fails to validate the filename received from the remote server, the ticket download process can write files outside the intended download directory. When overwrite is enabled, existing files that are accessible to the application can be replaced. This weakness can lead to unauthorized modification of critical files and potential integrity compromise. The identified weakness is CWE-22, a path traversal data validation error.

The affected product is the Siemens .NET Client Library for SIMATIC S7 Webserver API, specifically all versions earlier than V3.3.61. Users relying on these versions without the latest updates are exposed.

The CVSS score of 8.7 indicates a high severity of this issue. The EPSS score is not available, so the likelihood of exploitation is not quantified, but the absence of a KEV listing means no known public exploits have been reported yet. The attack vector appears to be remote, requiring an attacker capable of influencing the ticket response from a remote server. In environments where overwrite is enabled and filenames are not trusted, the exploitation could compromise files essential to application operation or security.