EUVD-2026-29426Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain TIA Portal project access
-
DeliveryInject XSS in PLC name fields
-
ExploitDeploy malicious project to S7-1500
-
ExecutionVictim accesses communication page
-
PersistExecute script in admin session
-
ImpactSteal tokens or modify PLC logic
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must possess credentials or authorization to download TIA Portal project files to SIMATIC S7-1500 PLCs-typically requires membership in plant engineering or system integrator role with write access to controller configurations. Exploitation further requires a second privileged user (with rights to access PLC web interface) to navigate to the specific 'communication' parameters page in the web UI after the malicious project has been deployed. The vulnerability does NOT affect default/unconfigured devices or routine PLC operations-stored payload only triggers during administrative web interface access to view communication settings. Network access to PLC web server (typically TCP/443 or 80) from victim's workstation is required; air-gapped or VLAN-isolated controllers without engineering station connectivity are not exploitable via this vector. No user interaction is required from the initial attacker during project upload phase (UI:N for that step), but subsequent victim interaction (UI:P) is mandatory for payload activation. |
| Impact | Real-world exploitation risk is moderate despite the critical 9.3 CVSS score due to significant exploitation barriers. CVSS vector PR:H (high privileges required) indicates the attacker must first possess TIA Portal project download authorization-typically reserved for plant engineers or system integrators with physical or VPN access to operational technology networks. The UI:P (passive user interaction required) means a privileged victim must subsequently view the communication parameters page to trigger payload execution. EPSS data not provided, and no CISA KEV listing confirms this is not currently exploited in the wild. However, the attack complexity is low (AC:L, AT:N) once prerequisites are met, and the scope change (S:H in CVSS 4.0) elevates impact beyond the web interface, potentially enabling session hijacking of engineering workstations or manipulation of PLC configurations. Primary risk scenario: supply chain compromise or insider threat where malicious TIA projects are introduced during commissioning, lying dormant until maintenance access triggers the payload. The absence of version-specific patches in CPE data (all show *:*:*:*) suggests either widespread vulnerability across product generations or incomplete vendor disclosure-defenders should verify exact affected firmware versions from Siemens advisory SSA-688146 before assuming all deployments are vulnerable. |
| Exploit ScenarioDerived | Attacker with compromised engineering credentials or supply chain access crafts a malicious TIA Portal project file containing JavaScript payloads embedded in PLC station name fields. During planned PLC commissioning or firmware update, the attacker or unwitting engineer downloads this project to S7-1500 controllers across the facility. Weeks later, a plant maintenance engineer logs into the PLC web interface with administrative credentials to troubleshoot network connectivity and navigates to the communication parameters page. The stored XSS payload executes in the engineer's browser session, exfiltrating session tokens to attacker-controlled infrastructure. Attacker uses hijacked session to modify PLC logic or disable safety interlocks without triggering change management alerts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – May 12, 2026
Stored cross-site scripting in Siemens SIMATIC S7-1500 controller family web interface allows authenticated high-privilege attackers to inject malicious code via crafted PLC/station names in TIA project files. When users with appropriate rights later access the communication parameters page, injected scripts execute in their session context with high impact to confidentiality, integrity, and availability across system boundaries (CVSS 9.3, CVSS:4.0 S:H). No public exploit identified at time of analysis, but CVSS vector indicates low attack complexity (AC:L) once attacker gains privileged project upload access.
Earlier versions of this analysis (1)
Stored XSS in Siemens SIMATIC S7-1500, ET 200SP, and Drive Controller family PLCs allows authenticated attackers with TIA project download privileges to inject malicious JavaScript into communication parameter fields that executes when administrators view the web interface page. Affects 100+ SIMATIC CPU models including Software Controllers and SIPLUS variants. Despite high 9.1 CVSS (critical), exploitation requires privileged authenticated access (PR:H) to modify PLC configurations, significantly limiting practical attack surface in operational technology environments. No CISA KEV listing or EPSS data available, suggesting limited active exploitation targeting industrial control systems at time of analysis.
RemediationAI
Apply firmware updates per Siemens ProductCERT advisory SSA-688146 (https://cert-portal.siemens.com/productcert/html/ssa-688146.html). Based on EUVD version data, fixed firmware versions include V2.9.9 or later for S7-1500 CPU 151x-1PN models, ET 200SP 1510/1512SP variants, and 1511C/1512C compact CPUs; V3.1.6 or later for S7-1500 CPU 1516/1517/1518 -3PN/DP and -4PN/DP models and Drive Controller 1504D/1507D TF variants. For product lines showing open-ended vulnerability ranges, contact Siemens support to confirm patch availability and compatibility with existing TIA Portal projects. Compensating controls until patching: restrict TIA Portal project download permissions to verified personnel only via role-based access control; implement mandatory code review of all TIA project files before deployment using static analysis tools to detect suspicious scripting in metadata fields; isolate engineering workstations accessing PLC web interfaces on dedicated VLANs without internet access; disable web server functionality on PLCs if HMI/SCADA provides sufficient monitoring (note: this prevents local diagnostics and may complicate troubleshooting); log all access to communication parameter pages and correlate with authorized maintenance windows to detect post-compromise reconnaissance. Trade-off: disabling web interface eliminates attack surface but requires alternative remote access methods (TIA Portal direct connection) increasing operational overhead.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a stored/persistent XSS vulnerability (CWE-79) affecting the web-based management interface of Siemens SIMATIC S7-1500 programmable logic controllers, SIMATIC ET 200SP CPUs, Drive Controllers, Software Controllers, and S7-PLCSIM Advanced simulation software. The affected products use TIA Portal (Totally Integrated Automation Portal) for engineering and configuration. When project configurations containing PLC or station names are downloaded to the device, these names are rendered on the 'communication' parameters page without proper sanitization. The vulnerability stems from inadequate input validation of user-supplied metadata fields in TIA project files. The CVSS 4.0 vector SC:H/SI:H/SA:H indicates exploitation can compromise confidentiality, integrity, and availability of subsequent system components beyond the vulnerable web interface itself, suggesting potential lateral movement or session hijacking scenarios within industrial control networks.
Know when Simatic Et 200Sp Cpu 1510Sp F 1 Pn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Primary rating from Vendor (siemens) · only source for this CVE.
CVSS VectorVendor: siemens
Lifecycle Timeline
3DescriptionCVE.org
Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page. If a benign user with appropriate rights accesses the "communication" parameters page, the malicious code would be executed in the scope of their web session.
Executive ViewAI
Siemens SIMATIC S7-1500 controllers contain a stored cross-site scripting vulnerability (CVSS 9.3) in the web interface that allows authenticated high-privilege users to inject malicious code through crafted project file uploads, executing in other users' sessions with potential impact to system confidentiality, integrity, and availability. This affects industrial control environments where multiple users access the same engineering and communication systems, creating insider risk and supply chain exposure if malicious project files are distributed. No vendor patch is currently available, requiring immediate detection and access controls.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict project file uploads to air-gapped engineering networks or VPN-authenticated connections only; (2) Limit web interface access to specific user accounts with IP whitelisting; (3) Disable web interface on non-essential S7-1500 units and use offline engineering tools instead; (4) Implement strict change control requiring peer review of all project file modifications before deployment; (5) Monitor web interface logs for unusual activity and script execution patterns; (6) Maintain and test offline backups of all controller configurations to enable rapid isolation/recovery of compromised units.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Stored cross-site scripting (XSS) in Siemens SIMATIC S7-1500 and ET 200SP controller families allows authenticated attac
Denial of service in Siemens industrial networking equipment allows remote unauthenticated attackers to crash affected d
Cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPU
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, Drive Controller and S7-1
Importing a maliciously crafted trace file into the integrated web server of a Siemens SIMATIC S7-1500 (and closely rela
Cross-site scripting (XSS) in Siemens SIMATIC S7-1500 PLC family firmware upload interface allows authenticated attacker
Stored cross-site scripting (CWE-79) in the integrated web server Trace page of Siemens SIMATIC S7-1500, ET 200SP, and S
Reflected cross-site scripting in the integrated web server of a broad range of Siemens SIMATIC S7-1500, ET 200SP, and D
Stored/DOM cross-site scripting (CWE-79, CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) in the web-based Trace
Cross-site scripting (CWE-79) in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Contr
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP and SIMATIC Drive Controll
GitHub PoC
Exploit-DB