What is the CVSS score of CVE-2026-63351?

CVE-2026-63351 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N. EPSS exploitation probability: 0.2%.

Siemens SIMATIC S7-1500 CVE-2026-63351

EUVD-2026-98382 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-10-13 siemens

GHSA-76mf-cjqf-w77p

5.3

CVSS 4.0 · Vendor: siemens

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft malicious CSV trace file
Delivery

Social-engineer authorized user to import it
Exploit

XSS triggers while rendering Trace page
Execution

Attacker JavaScript runs in victim session
Impact

Perform PLC operations within user's scope

Vulnerability Assessment

Weakness	CWE CWE-79 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Output encoding, context-aware escaping MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires an authenticated user holding the 'Read diagnostics' function right to manually import an attacker-crafted CSV trace file through the device's integrated web server Trace page; the malicious payload lives in the visual properties of calculated signals and only fires when that page renders. Limiting factors that reduce realistic risk: the device web server must be enabled and reachable, a specific privileged operator must be social-engineered into importing the file (UI:R), and any resulting PLC operations are bounded by that user's own authorization scope. There is no remote unauthenticated path against a default configuration - a human action by a rights-holding user is mandatory.
Impact	This is a medium-severity stored/DOM XSS (CWE-79, CVSS 6.1) in the integrated web server of Siemens SIMATIC S7-1500 / ET 200SP / Drive Controller CPUs, where visual properties of calculated signals in imported CSV trace files are rendered on the Trace page without sanitization. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows a network-reachable, low-complexity flaw with no attacker privileges but mandatory user interaction and a changed scope - the injected script runs in the victim's authenticated session and reaches PLC operations beyond the browser component. No EPSS score, CISA KEV listing, or public POC was provided in the input, so the exploitation signal is weak: no public exploit identified at time of analysis. The PR:N rating reflects that the attacker needs no credentials of their own, but exploitation is gated entirely on social-engineering a specific operator who holds the 'Read diagnostics' function right into importing a crafted file - a meaningful real-world limiter that the raw network vector understates. SSVC decision data (exploitation/automatable/technical-impact) was not supplied; based on the mechanics, exploitation is not automatable (requires per-victim interaction) and technical impact is partial. Net: a legitimate issue to patch in OT/ICS fleets, but practically targeted and user-dependent rather than a wormable, mass-exploitable priority.
Exploit ScenarioDerived	An attacker crafts a CSV trace file whose calculated-signal visual properties embed malicious JavaScript, then convinces an operator who holds the 'Read diagnostics' right to import it via the device's web Trace page. When the page renders the signal, the script executes in the operator's authenticated session and issues PLC operations through the web server within that user's authorization. No public exploit code was identified, and success depends on the user interaction and low attack complexity reflected in the CVSS vector.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 13, 2026

Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP and SIMATIC Drive Controller CPUs allows an attacker to bury JavaScript inside the visual properties of calculated signals in a crafted CSV trace file, which then executes in the browser session of anyone who imports that file and opens the Trace page. Exploitation is neither remote nor automatic: the CPU web server must be enabled and reachable, and a social-engineered operator holding the 'Read diagnostics' function right must import the file (CVSS 6.1, UI:R, PR:N), after which any resulting PLC operations are confined to that operator's own authorization scope. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.

RemediationAI

Siemens has published advisory SSA-591731 (https://cert-portal.siemens.com/productcert/html/ssa-591731.html), which should be consulted for the exact fixed firmware or product update versions for each listed CPU family; the input data does not specify a fix version, so patch availability cannot be confirmed here and the advisory is the authoritative source. Because exploitation requires a human import step and a reachable web server, the highest-value compensating controls are: disable the integrated web server on any CPU that does not need the diagnostics/Trace function (Trade-off: loss of browser-based diagnostics, trace viewing and remote monitoring); if the web server must stay enabled, restrict reachability of its HTTP/HTTPS ports to a dedicated, firewalled engineering VLAN or jump host so untrusted users and internet-adjacent networks cannot load the Trace page (Trade-off: added engineering friction and a single point of access to maintain); treat CSV trace files as untrusted input and only import files generated by a trusted engineering station or received over a verified channel, since the payload is invisible until the Trace page renders it; and review assignment of the 'Read diagnostics' function right so that only personnel who genuinely need trace/diagnostic access hold it (Trade-off: reduces the pool of users who can perform diagnostics, so plan for a small on-call group). Browser-side hardening (script blockers, running diagnostics sessions in a dedicated profile) reduces but does not eliminate the impact, because the injected script executes in the CPU web server's origin and can still drive PLC operations within the victim's authorization. No vendor-released patch version, and no public exploit code or active exploitation, is confirmed from the provided data; monitor the Siemens advisory for firmware updates and apply them as soon as they are published.

Affected VersionsENISA

SIMATIC S7-1500 CPU 1513pro-2 PN 0 <*

SIMATIC S7-1500 CPU 1517-3 PN 0 <*

SIMATIC S7-1500 CPU 1517F-3 PN/DP 0 <*

SIPLUS S7-1500 CPU 1518F-4 PN/DP 0 <*

SIPLUS S7-1500 CPU 1513-1 PN 0 <*

SIMATIC S7-1500 Software Controller Linux V3 0 <*

SIPLUS S7-1500 CPU 1516-3 PN/DP RAIL 0 <*

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 0 <*

SIMATIC S7-1500 CPU 1515TF-2 PN 0 <*

SIMATIC S7-1500 CPU 1517-3 PN/DP 0 <*

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 0 <*

SIMATIC S7-1500 CPU 1513F-1 PN 0 <*

SIMATIC S7-1500 CPU 1518-4 PN/DP 0 <*

SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL 0 <*

SIMATIC S7-1500 Software Controller CPU 1507S V3 0 <*

SIMATIC ET 200SP CPU 1514SP-2 PN 0 <*

SIPLUS ET 200SP CPU 1512SP-1 PN RAIL 0 <*

SIMATIC ET 200SP CPU 1514SPT-2 PN 0 <*

SIMATIC ET 200SP CPU 1512SP F-1 PN 0 <*

SIMATIC S7-1500 CPU 1512C-1 PN 0 <*

SIMATIC S7-1500 Software Controller CPU 1508S TF V3 0 <*

SIMATIC ET 200SP CPU 1510SP F-1 PN 0 <*

SIPLUS ET 200SP CPU 1512SP F-1 PN 0 <*

SIPLUS S7-1500 CPU 1515F-2 PN 0 <*

SIMATIC S7-1500 Software Controller CPU 1508S F V2 0 <*

SIMATIC S7-1500 CPU 1516pro F-2 PN 0 <*

SIMATIC S7-1500 CPU 1516-3 PN/DP 0 <*

SIMATIC S7-1500 Software Controller CPU 1508S V3 0 <*

SIMATIC S7-1500 Software Controller CPU 1508S V2 0 <*

SIMATIC S7-1500 CPU 1516T-3 PN 0 <*

SIPLUS ET 200SP CPU 1510SP F-1 PN RAIL 0 <*

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 0 <*

SIMATIC S7-1500 CPU 1513-1 PN 0 <*

SIMATIC S7-1500 ET 200pro: CPU 1513PRO F-2 PN 0 <*

SIMATIC ET 200SP CPU 1510SP-1 PN 0 <*

SIMATIC S7-1500 CPU 1516TF-3 PN/DP 0 <*

SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V2 CPUs - Windows OS 0 <*

SIMATIC S7-1500 CPU 1511C-1 PN 0 <*

SIMATIC S7-PLCSIM Advanced 0 <*

SIMATIC S7-1500 CPU 1518F-3 PN 0 <*

SIMATIC S7-1500 CPU 1517F-3 PN 0 <*

SIMATIC S7-1500 CPU 1511TF-1 PN 0 <*

SIMATIC ET 200SP CPU 1514SP F-2 PN 0 <*

SIMATIC S7-1500 CPU 1517T-3 PN 0 <*

SIPLUS S7-1500 CPU 1511-1 PN 0 <*

SIMATIC S7-1500 Software Controller Linux V2 0 <*

SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL 0 <*

SIPLUS ET 200SP CPU 1510SP-1 PN 0 <*

SIMATIC S7-1500 CPU 1516pro-2 PN 0 <*

SIPLUS ET 200SP CPU 1510SP F-1 PN 0 <*

SIPLUS S7-1500 CPU 1513F-1 PN 0 <*

SIMATIC S7-1500 CPU 1511-1 PN 0 <*

SIMATIC S7-1500 Software Controller CPU 1508S F V3 0 <*

SIMATIC S7-1500 Software Controller CPU 1507S F V3 0 <*

SIMATIC S7-1500 CPU 1515T-2 PN 0 <*

SIPLUS ET 200SP CPU 1510SP-1 PN RAIL 0 <*

SIPLUS ET 200SP CPU 1512SP-1 PN 0 <*

SIMATIC S7-1500 CPU 1518T-4 PN/DP 0 <*

SIPLUS S7-1500 CPU 1511-1 PN TX RAIL 0 <*

SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Windows OS 0 <*

SIMATIC S7-1500 CPU 1513pro F-2 PN 0 <*

SIMATIC S7-1500 Software Controller CPU 1507S V2 0 <*

SIMATIC S7-1500 CPU 1517T-3 PN/DP 0 <*

SIMATIC S7-1500 Software Controller CPU 1507S F V2 0 <*

SIMATIC S7-1500 CPU 1516F-3 PN/DP 0 <*

SIPLUS S7-1500 CPU 1516-3 PN/DP TX RAIL 0 <*

SIMATIC S7-1500 Software Controller CPU 1508S V4 0 <*

SIPLUS S7-1500 CPU 1515F-2 PN T2 RAIL 0 <*

SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL 0 <*

SIMATIC S7-1500 CPU 1518F-4 PN/DP 0 <*

SIMATIC S7-1500 CPU 1517TF-3 PN 0 <*

SIMATIC S7-1500 Software Controller CPU 1507S V4 0 <*

SIMATIC S7-1500 CPU 1516TF-3 PN 0 <*

SIMATIC Drive Controller CPU 1507D TF 0 <*

SIMATIC S7-1500 CPU 1515-2 PN 0 <*

SIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODK 0 <*

SIMATIC S7-1500 CPU 1518TF-4 PN/DP 0 <*

SIPLUS S7-1500 CPU 1511F-1 PN 0 <*

SIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PN 0 <*

SIMATIC S7-1500 CPU S7-1518-4 PN/DP ODK 0 <*

SIMATIC S7-1500 CPU 1511F-1 PN 0 <*

SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 CPUs 0 <*

SIMATIC S7-1500 CPU 1511T-1 PN 0 <*

SIMATIC S7-1500 CPU 1516T-3 PN/DP 0 <*

SIMATIC Drive Controller CPU 1504D TF 0 <*

SIMATIC S7-1500 CPU 1518-3 PN 0 <*

SIMATIC S7-1500 CPU 1517TF-3 PN/DP 0 <*

SIMATIC S7-1500 Software Controller CPU 1508S T V3 0 <*

SIMATIC S7-1500 CPU 1515F-2 PN 0 <*

SIPLUS S7-1500 CPU 1515F-2 PN RAIL 0 <*

SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) 0 <*

SIMATIC S7-1500 CPU 1518TF-3 PN 0 <*

SIPLUS S7-1500 CPU 1518-4 PN/DP 0 <*

SIMATIC ET 200SP CPU 1512SP-1 PN 0 <*

SIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PN 0 <*

SIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PN 0 <*

SIPLUS S7-1500 CPU 1516F-3 PN/DP 0 <*

SIMATIC S7-1500 Software Controller CPU 1507S F V4 0 <*

SIMATIC S7-1500 CPU 1518T-3 PN 0 <*

SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Industrial OS 0 <*

SIPLUS S7-1500 CPU 1516-3 PN/DP 0 <*

SIMATIC S7-1500 Software Controller CPU 1508S F V4 0 <*

SIMATIC ET 200SP CPU 1514SPT F-2 PN 0 <*

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), manifesting as stored/DOM cross-site scripting in the diagnostic web interface of Siemens SIMATIC S7-1500 family controllers. Trace functionality in these CPUs lets engineers record signal values to CSV files and re-import them for graphical analysis on the device's built-in Trace page; the affected firmware fails to validate and sanitize the visual properties of calculated signals carried in those imported CSV files before rendering them, so attacker-supplied markup is emitted into the DOM. Because the page is served from the CPU's own web server origin, the injected script inherits that origin and the victim's authenticated session, which is why the CVSS vector scores S:C (scope changed) and allows attacker-controlled JavaScript to invoke PLC operations through the web server as the logged-in user. The CPE data enumerates the exposed hardware and firmware products, including SIMATIC Drive Controller CPU 1504D TF and 1507D TF, ET 200SP CPUs 1510SP(-1 PN), 1510SP F-1 PN, 1512SP(-1 PN) and 1512SP F-1 PN, plus the wider S7-1500 portfolio (1511 through 1518 including F, T, TF, C, PRO, ODK and MFP variants), S7-1500 Software Controllers 1507S/1508S, SIMATIC S7-PLCSIM Advanced, and SIPLUS ruggedized equivalents. The attack surface is the classic engineering/diagnostics access path rather than the control network itself.

Know when Simatic Et 200Sp Cpu 1510Sp F 1 Pn gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (siemens) PRIMARY 5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

vuln.today AI 6.1 MEDIUM

Attacker needs no own credentials (PR:N) but must get a privileged user to import a file (UI:R); injected script crosses from browser to PLC operations, so S:C with low C/I and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (siemens).

CVSS VectorVendor: siemens

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

Passive

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

None

Subsequent system: Confidentiality

Low

Subsequent system: Integrity

Low

Subsequent system: Availability

None

Lifecycle Timeline

CVSS changed

Oct 13, 2026 - 10:22 NVD

6.1 (MEDIUM) 5.3 (MEDIUM)

CVE Published

Oct 13, 2026 - 09:18 cve.org

MEDIUM 6.1

DescriptionCVE.org

Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page.

This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.

Threat Intelligence Overview

EPSS Score

0.2%

Top 86% exploitable

Prevalence

Medium

flagship Siemens PLC family, dominant in OT but industrial-only footprint

Social Media

Sightings

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +26

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Cross-Site Scripting MEDIUM

Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.

More in Simatic Et 200Sp Cpu 1510Sp F 1 Pn

View all

CVE-2026-25787 CRITICAL Emergency

9.3 May 12

Stored cross-site scripting (XSS) in Siemens SIMATIC S7-1500 and ET 200SP controller families allows authenticated attac

CVE-2026-25786 CRITICAL Emergency

9.3 May 12

Stored cross-site scripting in Siemens SIMATIC S7-1500 controller family web interface allows authenticated high-privile

CVE-2025-40833 HIGH Act Now

8.7 May 12

Denial of service in Siemens industrial networking equipment allows remote unauthenticated attackers to crash affected d

CVE-2026-63354 CRITICAL Act Now

9.4 Oct 13

Cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPU

CVE-2026-63353 CRITICAL Act Now

9.4 Oct 13

Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, Drive Controller and S7-1

CVE-2026-63350 CRITICAL Act Now

9.4 Oct 13

Importing a maliciously crafted trace file into the integrated web server of a Siemens SIMATIC S7-1500 (and closely rela

CVE-2026-25789 HIGH Act Now

7.2 May 12

Cross-site scripting (XSS) in Siemens SIMATIC S7-1500 PLC family firmware upload interface allows authenticated attacker

CVE-2026-63357 MEDIUM This Month

5.3 Oct 13

Stored cross-site scripting (CWE-79) in the integrated web server Trace page of Siemens SIMATIC S7-1500, ET 200SP, and S

CVE-2026-63356 MEDIUM This Month

5.3 Oct 13

Reflected cross-site scripting in the integrated web server of a broad range of Siemens SIMATIC S7-1500, ET 200SP, and D

CVE-2026-63355 MEDIUM This Month

5.3 Oct 13

Stored/DOM cross-site scripting (CWE-79, CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) in the web-based Trace

CVE-2026-63352 MEDIUM This Month

5.3 Oct 13

Cross-site scripting (CWE-79) in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Contr

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all

CVE-2020-3580 MEDIUM POC

6.1

CVE-2013-7389 MEDIUM POC

4.3

CVE-2021-25299 MEDIUM POC

6.1

CVE-2014-2120 MEDIUM

6.1

CVE-2023-40000 HIGH POC

8.3

CVE-2016-8581 MEDIUM POC

6.1

CVE-2013-5223 MEDIUM POC

5.4

CVE-2025-52367 MEDIUM POC

5.4

Same technique XSS

View all

CVE-2017-9248 CRITICAL POC

9.8

CVE-2013-1710 CRITICAL POC

10.0

CVE-2024-52875 HIGH POC

8.8

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-63351 ADVISORY https://vuldb.com/vuln/417508 REF https://cert-portal.siemens.com/productcert/html/ssa-591731.html

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back