EUVD-2026-98384
GHSA-qm94-q84w-4cgf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft trace file with malicious comment
-
DeliverySocial-engineer diagnostics user to import
-
ExploitStored XSS renders on Trace page
-
ExecutionJavaScript runs in victim session
-
ImpactPerform PLC operations via web server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the CPU's integrated web server to be reachable and a victim who is an authenticated operator holding the specific 'Read diagnostics' function right. The attacker cannot trigger the flaw directly: it is gated by active user interaction (UI:A) - the victim must be social-engineered into importing an attacker-supplied, specially crafted trace file, after which the malicious comment executes when the Trace page is viewed. Limiting factors that reduce realistic risk: dependence on successful social engineering, the requirement that the victim already possess diagnostic authorization (impact is bounded by that user's privilege scope), and the need for the web server interface to be enabled/accessible. This is not exploitable against a default configuration without a privileged human in the loop. |
| Impact | This is a stored cross-site scripting (CWE-79) flaw in the web server of Siemens SIMATIC S7-1500 / ET 200SP / Drive Controller CPUs, where comment fields of imported trace files are rendered unsanitized on the Trace page. The CVSS 4.0 base score of 9.4 is driven by AV:N, AC:L, PR:N and - critically - the subsequent-system impacts (SC:H/SI:H/SA:H), reflecting that injected JavaScript can pivot into PLC operations, not merely compromise the browser. However, the vector carries UI:A (active user interaction), and the description makes clear exploitation is NOT self-driving: an attacker must social-engineer an authorized operator who holds the 'Read diagnostics' function right into importing a crafted trace file. This sharply reduces real-world likelihood versus the headline score - it is operator-dependent, not a remote unauthenticated drive-by. No EPSS score, CISA KEV listing, or public exploit code was provided in the intelligence, so there is no evidence of active exploitation or automatable mass attack; the only source is the Siemens advisory. Note a signal tension worth flagging to defenders: the 4.0 vector states PR:N (attacker needs no privileges) yet successful impact depends entirely on the privileges of the social-engineered victim - the 'unauthenticated' framing applies to the attacker, not to the preconditions. Net assessment: a genuinely high-impact-if-triggered OT vulnerability, but one gated behind targeted social engineering of a privileged user rather than a widespread, opportunistic threat - prioritize patching in exposed/HMI-facing environments, but treat the 9.4 as an upper bound. |
| Exploit ScenarioDerived | An attacker crafts a trace file embedding malicious JavaScript in a comment field and, via social engineering (e.g. a 'diagnostic log to review' sent to a support engineer), persuades an authorized user holding the 'Read diagnostics' function right to import it into the CPU web server. When the operator opens the Trace page, the script executes in their authenticated session and can issue PLC operations within the scope of that user's authorization. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 13, 2026
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, Drive Controller and S7-1500 Software Controller CPUs lets attacker-controlled JavaScript execute in a privileged operator's browser session after that user is social-engineered into importing a crafted trace file and its unsanitized comment fields are rendered on the Trace page (reported CVSS 4.0 base 9.4; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Because the script runs inside the victim's authenticated session, it can perform PLC operations through the same web server within the scope of that user's authorization, so impact is bounded by the victim's privileges rather than by the attacker's. Exploitation is gated by user interaction and by a reachable/enabled CPU web server, and the victim must already hold the 'Read diagnostics' function right; no public exploit code or CISA KEV entry is associated with this CVE in the available data (no public exploit identified at time of analysis).
Earlier versions of this analysis (1)
Cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPUs allows attacker-controlled JavaScript to run in the browser session of an authenticated diagnostics user who imports a malicious trace file. The comment field of an imported trace file is not sanitized before being rendered on the Trace page, so the injected script executes with the victim's session privileges and can then issue PLC operations through the web server within the scope of that user's authorization (CVSS 3.1 base 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Exploitation is not autonomous - it depends on social engineering the victim into importing and viewing the crafted trace file, and only succeeds if the victim already holds the 'Read diagnostics' function right; no public exploit code has been identified at time of analysis. The flaw is a stored/persistent CWE-79 issue affecting the CPU web server, which must be enabled and reachable for the attack to work.
RemediationAI
No exact patched firmware version is stated in the data available for this analysis, so the primary action is to consult and apply the vendor guidance in Siemens Security Advisory SSA-591731 (https://cert-portal.siemens.com/productcert/html/ssa-591731.html), which lists the affected CPU/firmware matrix and the corresponding updates; treat that advisory as the authoritative patch reference rather than any third-party version claim. Until the applicable firmware update can be deployed, the following compensating controls reduce exposure, each with trade-offs: disable the integrated web server on CPUs where remote diagnostics are not operationally required (in TIA Portal hardware configuration, uncheck 'Enable web server' / restrict it to read-only or disable it entirely) - the trade-off is loss of browser-based diagnostics, trace collection and remote maintenance, and some sites may need to re-enable it temporarily for service work; segment and firewall access to the web server so that only the engineering/diagnostics VLAN can reach TCP 80/443 on these CPUs (per IEC 62443 zone-and-conduit practice) - this does not fix the bug but blocks delivery of the malicious trace file from untrusted networks, and it requires accurate asset inventory and firewall change control; restrict the 'Read diagnostics' function right so only the minimum set of accounts holds it, and use dedicated, non-shared accounts for diagnostic work - this directly shrinks the population of exploitable sessions but can slow troubleshooting; and block the import of trace files from external or emailed sources, requiring files to be validated/copied by engineering staff from trusted media before import - this defeats the social-engineering step but relies on operator discipline rather than a technical control. Note that the flaw requires the user to view the Trace page after import, so instructing operators to close the Trace view (or the browser session) if an unexpected or unsolicited trace file is imported limits the script's window, though it is not a substitute for patching. Browser-side measures such as strict Content Security Policy are not configurable by the defender for firmware-embedded web pages and should not be counted on here.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-79 cross-site scripting issue (specifically the stored/persistent variant) in the diagnostic trace-file import functionality exposed by the integrated web server of the Siemens SIMATIC S7-1500 controller family. Trace files are diagnostics artifacts that operators upload through the web interface; the importer copies comment fields out of the file without output encoding, and those fields are later written into the DOM of the Trace page, where they are interpreted as markup and script rather than inert text. The assessed vector uses UI:R and a scope change (S:C), which reflects that the injected script escapes the browser context of the imported file and acts with the privileges of the already-authenticated session: the script can drive PLC operations through the same web server endpoints the operator is entitled to use, making the practical severity dependent on the victim's function rights. The reported CVSS 4.0 vector carries PR:N, i.e. the attacker needs no credentials of their own, but exploitation still requires an authenticated victim with the 'Read diagnostics' function right plus successful social engineering to import the file. Affected CPE strings confirm the scope is the CPU firmware/web-server component rather than a desktop tool: SIMATIC Drive Controller CPU 1504D TF and 1507D TF, SIMATIC ET 200SP CPUs (1510SP-1 PN, 1510SP F-1 PN, 1512SP-1 PN, 1512SP F-1 PN and related variants), and, per the associated tag list, the broader S7-1500 CPU portfolio (1511, 1513, 1515, 1516, 1517, 1518, plus F/T/TF/PRO, C, and Siplus variants), ET 200SP Open Controller (1515SP PC/PC2/PC3) and S7-1500 Software Controller (1507S/1508S, Windows, Linux, T and TF variants, V2-V4) as well as SIMATIC S7-PLCSIM Advanced.
Know when Simatic Et 200Sp Cpu 1510Sp F 1 Pn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Attacker needs no account (PR:N) but requires victim to import the file (UI:R); injected script escapes the browser context to drive PLC operations via the web server, so S:C with full C/I/A impact.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
2DescriptionCVE.org
Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
Executive ViewAI
A stored cross-site scripting flaw in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, Drive Controller and S7-1500 Software Controller CPUs allows attacker-supplied JavaScript to run inside an authenticated operator's browser session once that operator is persuaded to import a crafted trace file, letting the script issue PLC operations using the victim's own authorization. No vendor-released patch is identified at time of analysis and no public exploit code or CISA KEV entry is associated with this CVE, so near-term exposure is driven by operational hygiene rather than active attack campaigns. Leadership should care because the affected devices sit on the OT floor controlling physical processes, the blast radius extends beyond the victim's workstation to any PLC action that operator is entitled to perform, and remediation currently depends entirely on compensating controls we must impose ourselves.
No vendor-released patch identified at time of analysis; interim mitigations are to disable the CPU integrated web server where not operationally required and otherwise segment it behind an engineering VLAN with host allowlists, restrict the 'Read diagnostics' function right to least privilege, block or vet inbound trace file imports, and monitor web server access and operator browser activity for anomalous PLC operations. Apply vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Stored cross-site scripting (XSS) in Siemens SIMATIC S7-1500 and ET 200SP controller families allows authenticated attac
Stored cross-site scripting in Siemens SIMATIC S7-1500 controller family web interface allows authenticated high-privile
Denial of service in Siemens industrial networking equipment allows remote unauthenticated attackers to crash affected d
Cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPU
Importing a maliciously crafted trace file into the integrated web server of a Siemens SIMATIC S7-1500 (and closely rela
Cross-site scripting (XSS) in Siemens SIMATIC S7-1500 PLC family firmware upload interface allows authenticated attacker
Stored cross-site scripting (CWE-79) in the integrated web server Trace page of Siemens SIMATIC S7-1500, ET 200SP, and S
Reflected cross-site scripting in the integrated web server of a broad range of Siemens SIMATIC S7-1500, ET 200SP, and D
Stored/DOM cross-site scripting (CWE-79, CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) in the web-based Trace
Cross-site scripting (CWE-79) in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Contr
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP and SIMATIC Drive Controll
Exploit-DB