EUVD-2026-98383
GHSA-649x-vx66-pwxj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious CSV trace file
-
DeliverySocial-engineer diagnostics user to import
-
ExploitTrace page renders unsanitized signal data
-
ExecutionAttacker JavaScript executes in session
-
ImpactPerform PLC operations as authorized user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker to socially engineer an authenticated web-interface user who holds the 'Read diagnostics' function right into importing a specially crafted CSV trace file; the XSS payload executes only when the CPU's web server renders that unsanitized calculated signal data on the Trace page. Limiting factors: it is not exploitable without active victim interaction (the file import), the victim must already be authenticated and possess the specific diagnostics privilege, and the resulting PLC operations are bounded by that user's authorization scope. There is no path to unauthenticated, no-interaction remote exploitation despite the AV:N rating. |
| Impact | This is a stored/DOM cross-site scripting issue (CWE-79) in the web server of Siemens SIMATIC S7-1500 / ET 200SP / Drive Controller CPUs, where calculated signal data from imported CSV trace files is rendered on the Trace page without sanitization. The CVSS 3.1 base score is 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. While the attack vector is listed as Network with no attacker privileges (PR:N), the UI:R flag is the dominant risk limiter: exploitation cannot occur without a legitimate, authenticated operator who holds the 'Read diagnostics' function right being socially engineered into importing an attacker-supplied file. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of required social engineering, required victim authentication/privilege, and the file-import precondition means real-world risk is well below what the 'network' vector alone might suggest - this is a Medium-severity, interaction-gated issue rather than a drive-by remotely exploitable flaw. The scope change (S:C) and impact on PLC operations within the victim's authorization are the reasons it rates above a trivial reflected XSS, because successful execution can pivot to control actions on industrial equipment. |
| Exploit ScenarioDerived | An attacker crafts a malicious CSV trace file embedding JavaScript within calculated signal data fields, then uses social engineering (e.g., a support-themed email) to convince an operator holding the 'Read diagnostics' right to import it into the CPU's web interface. When the Trace page renders the unsanitized data, the attacker's script executes in the operator's authenticated session and issues PLC operations within the scope of that user's authorization. No public proof-of-concept exploit was identified in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Cross-site scripting (CWE-79) in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPUs allows attacker-controlled JavaScript to run in an operator's browser when a crafted CSV trace file is imported and its calculated signal data is rendered on the Trace page. Exploitation is not automatic: an attacker must socially engineer a user who already holds the 'Read diagnostics' function right into importing the malicious file, and the injected script then executes within that user's session and can drive PLC operations through the web server, limited to that user's authorization scope. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1) reflects that access is remote over the network but requires victim interaction; there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
RemediationAI
No vendor-released patch version is specified in the available data, so the authoritative source for fixed firmware levels and the exact remediation matrix for each CPU family and generation is Siemens security advisory SSA-591731 (https://cert-portal.siemens.com/productcert/html/ssa-591731.html); apply the firmware updates listed there for every affected S7-1500, ET 200SP, Drive Controller, Software Controller, SIPLUS, and PLCSIM Advanced instance, and verify the installed revision afterwards because the CPE data flags all versions. Until the corresponding firmware can be deployed, the most effective compensating control is to stop untrusted data from reaching the vulnerable renderer: the web server is the attack surface, so restrict access to it (firewall/ACL the CPU's HTTP/HTTPS ports to engineering workstations only, or disable the web server entirely where remote diagnostics are not required - noting that disabling it removes legitimate browser-based diagnostics and Trace functionality), and treat CSV trace files as untrusted input by importing only files generated internally and transferred over a controlled channel rather than received by email or download. Because the exploit depends on the 'Read diagnostics' function right, audit and minimize that privilege to the smallest set of accounts that genuinely need trace analysis, and prefer per-user accounts over shared credentials so a compromised session is not amplified - accepting that this limits, but does not eliminate, exposure for the users who must retain the right. Additional hardening includes network segmentation of the controller VLAN away from general IT and browsing workstations, blocking outbound browsing or script execution from engineering hosts that also open the PLC web UI, and monitoring web-server access logs for unusual Trace-page imports; note that none of these measures fix the underlying unsanitized rendering and all are reduced in value once a patched firmware release from the vendor is available.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected products are Siemens SIMATIC controller families whose firmware exposes an embedded web server with a diagnostics/Trace feature: SIMATIC S7-1500 CPUs (including F, T, TF, C, PRO, and ODK variants), SIMATIC ET 200SP CPUs (1510SP-1 PN, 1510SP F-1 PN, 1512SP-1 PN, 1512SP F-1 PN, 1514SP/1514SPT, and Open Controller 1515SP PC), SIMATIC Drive Controllers (CPU 1504D TF, CPU 1507D TF), SIMATIC S7-1500 Software Controller variants (CPU 1507S/1508S, including Linux and T/TF SKUs), SIPLUS ruggedized equivalents, and SIMATIC S7-PLCSIM Advanced. The weakness class is CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., cross-site scripting): calculated signal data parsed from an imported CSV trace file is written into the Trace page without output encoding, so HTML/JavaScript embedded in that field is interpreted by the browser instead of displayed as text. Because the injected script runs in the context of the controller's web interface under the victim's authenticated session, the browser's origin of the PLC web server becomes attacker-controlled - consistent with the S:C (scope changed) component of the assessed vector - and can invoke the same web-server functions the victim is authorized to use, including PLC operations. The AV:N/L/PR:N components describe the delivery channel (network-served web UI and a shareable file), while UI:R captures the mandatory social-engineering step of the victim importing the file.
Know when Simatic Et 200Sp Cpu 1510Sp F 1 Pn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Payload is delivered over the network and the attacker needs no account, but a privileged victim must import the file (UI:R); script escaping the web server into the user session yields S:C with low C/I and no availability impact.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
2DescriptionCVE.org
Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Stored cross-site scripting (XSS) in Siemens SIMATIC S7-1500 and ET 200SP controller families allows authenticated attac
Stored cross-site scripting in Siemens SIMATIC S7-1500 controller family web interface allows authenticated high-privile
Denial of service in Siemens industrial networking equipment allows remote unauthenticated attackers to crash affected d
Cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPU
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, Drive Controller and S7-1
Importing a maliciously crafted trace file into the integrated web server of a Siemens SIMATIC S7-1500 (and closely rela
Cross-site scripting (XSS) in Siemens SIMATIC S7-1500 PLC family firmware upload interface allows authenticated attacker
Stored cross-site scripting (CWE-79) in the integrated web server Trace page of Siemens SIMATIC S7-1500, ET 200SP, and S
Reflected cross-site scripting in the integrated web server of a broad range of Siemens SIMATIC S7-1500, ET 200SP, and D
Stored/DOM cross-site scripting (CWE-79, CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) in the web-based Trace
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP and SIMATIC Drive Controll
Exploit-DB