EUVD-2026-98385
GHSA-42fq-r5j4-9gwp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious CSV trace file
-
ExploitSocial-engineer diagnostics user to import it
-
ExecutionInjected JavaScript executes in browser session
-
ImpactPerform unauthorized PLC operations as user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a crafted CSV trace file containing malicious visual-marker data AND an authenticated web-server user who holds the 'Read diagnostics' function right to be socially engineered into importing that file onto the controller, after which the Trace page renders it and the script executes. Limiting factors: the attack is not autonomous - it depends on victim user interaction (UI:A) and on the victim possessing a specific function right, meaning low-privilege or unauthenticated endpoints alone cannot trigger it; impact is bounded by the victim's authorization scope within the web server; and exposure is reduced where the controller web server is network-segmented from untrusted users per Siemens' ICS hardening guidance. |
| Impact | This is a CWE-79 stored/DOM cross-site scripting flaw in the web server of Siemens SIMATIC S7-1500, ET 200SP, and Drive Controller CPU families, where visual-marker data from imported CSV trace files is rendered unsanitized on the Trace page. Siemens' CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) scores 9.4 (Critical), with high confidentiality, integrity, and availability impact on both the vulnerable and the subsequent system (VC/VI/VA:H and SC/SI/SA:H) - the subsequent-system impact reflects that injected JavaScript can drive PLC operations through the web server. The signals are mixed: the CVSS AT:N/PR:N presentation suggests easy remote reach, but the description makes clear that exploitation is NOT self-contained - it requires UI:A, i.e. an attacker must social-engineer a logged-in user holding the 'Read diagnostics' function right into importing a crafted file, so this is a user-interaction-gated, social-engineering-dependent attack rather than a drive-by remote compromise. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization; realistically this is a high-severity-but-exploitation-gated issue whose practical risk depends heavily on operator vigilance and the OT/ICS context. Because these are safety-relevant industrial controllers, the potential impact of unauthorized PLC operations is serious even if the exploitation barrier is non-trivial. |
| Exploit ScenarioDerived | An attacker crafts a malicious CSV trace file embedding JavaScript in its visual-marker data and, via phishing or pretexting, convinces an engineer who holds the 'Read diagnostics' function right to import it into the controller's web interface. When the Trace page renders the file, the attacker's script executes in the victim's authenticated session and issues PLC operations within the victim's authorization scope. No public exploit code is identified at time of analysis, and the attack cannot proceed without the victim importing the file (UI:A). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 13, 2026
Cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPU families allows an attacker to have malicious JavaScript run in the browser session of a plant engineer who imports a booby-trapped CSV trace file. The flaw is CWE-79: visual-marker data inside imported CSV trace files is not validated or sanitized before it is rendered on the controller's Trace page, so script embedded in that field executes in the web-server origin once the file is opened. Exploitation is not autonomous - per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) it is unauthenticated at the network layer but requires user interaction (UI:R) and a victim holding the 'Read diagnostics' function right, and the resulting script can perform PLC operations through the web server limited to that user's authorization; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). The severity is high (CVSS 4.0 base 9.4; assessed 3.1 10.0 with scope change) because a successful script can reach high-integrity PLC operations from the controller's own trusted web session.
Earlier versions of this analysis (1)
Cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500 controllers and related SIMATIC families (ET 200SP, Drive Controller, Software Controller, S7-PLCSIM Advanced) allows attacker-controlled JavaScript to run in the browser session of an operator who imports a malicious CSV trace file, from which the attacker can then issue PLC operations within that operator's authorization scope. Successful exploitation requires a specifically privileged victim - an authenticated user holding the 'Read diagnostics' function right - to be socially engineered into importing the crafted file and viewing the Trace page, so the issue is not remotely automatable against unattended or default configurations despite its 9.6 CVSS base score (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). No public exploit code has been identified at time of analysis and there is no confirmation of active exploitation; Siemens published advisory SSA-591731 for this issue.
RemediationAI
No vendor-released patch version is specified in the available data; consult Siemens security advisory SSA-591731 (https://cert-portal.siemens.com/productcert/html/ssa-591731.html) for the authoritative firmware update list and apply the corresponding SIMATIC S7-1500 / ET 200SP / Drive Controller firmware release to every affected CPU, plus updates to SIMATIC S7-1500 Software Controller and PLCSIM Advanced. Until firmware can be rolled out, the highest-value compensating control is procedural and technical restriction of trace-file import: only import CSV trace files that were exported locally from a trusted source, and treat any externally supplied trace file as untrusted - this directly removes the delivery vector but depends entirely on user discipline, since the attack is social-engineering based. Disable or restrict the CPU web server (or block TCP 80/443 to controllers from all non-engineering networks) where remote diagnostics over HTTP are not required; the trade-off is loss of browser-based diagnostics, trace viewing and monitoring, which may be unacceptable for maintenance workflows. Segment the controller network from office/IT and Internet-reachable zones per Siemens ICS hardening guidance so an attacker cannot reach the web server to deliver the crafted file, understanding that this does not protect against an insider or a compromised engineering workstation. Finally, review and minimize the assignment of the 'Read diagnostics' function right so that the number of users whose session could be hijacked into issuing PLC operations is as small as possible, and configure browsers used for PLC diagnostics to block script execution from the controller origin where feasible - a measure that may break the legitimate Trace page functionality.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected products are the CPU modules and software controllers of the Siemens SIMATIC S7-1500 controller family - CPE entries include siemens:simatic_s7_1500_cpu_1511_1_pn through the 1518 4 PN/DP, T/TF, F and ODK variants, the ET 200SP CPUs (1510SP-1 PN, 1512SP-1 PN, 1514SP-2 PN and their F/T variants), SIMATIC Drive Controller CPU 1504D TF and 1507D TF, plus SIPLUS and SIMATIC S7-1500 Software Controller / PLCSIM Advanced / Open Controller 1515SP PC editions. These devices embed an HTTP web server used for diagnostics, configuration and engineering access. The vulnerability class is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored/client-side XSS pattern: the Trace function supports importing CSV trace files that contain visual marker definitions, and the application fails to validate and sanitize that marker data before rendering it back on the Trace page. Because the injected markup is rendered from within the PLC web server's own origin, any script that executes inherits the DOM, cookies and any session context of the logged-in operator, and can therefore issue same-origin requests to the web server - which is why the flaw escalates from a display-level scripting bug to an integrity and availability risk for the control process, bounded by the authenticated victim's function rights.
Know when Simatic Et 200Sp Cpu 1510Sp F 1 Pn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Attacker needs no privileges (PR:N) but the victim must actively import the file (UI:R); injected script escapes the web component to drive PLC operations, so S:C with high C/I/A.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
2DescriptionCVE.org
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
Executive ViewAI
A critical cross-site scripting flaw in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPUs allows a malicious CSV trace file to run arbitrary script in the browser session of a plant engineer who imports it, from which the attacker could issue PLC operations using that engineer's own authorization. Because the affected devices are production controllers, a successful attack could disrupt or manipulate physical processes, making this a safety and availability concern for operations, engineering, and OT security leadership rather than an IT-only issue. No vendor-released patch is available today, and no public exploit code has been identified at time of analysis, so the immediate priority is limiting exposure and controlling who can open untrusted trace files.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the controller integrated web server to trusted engineering hosts or a management VLAN; do not import CSV trace files from untrusted or unverified sources; limit the 'Read diagnostics' function right to the minimum necessary personnel; harden engineering workstation browsers and avoid persistent sessions; monitor and alert on web-server access and PLC configuration changes; apply Siemens advisory mitigations and replace with the vendor patch once released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Stored cross-site scripting (XSS) in Siemens SIMATIC S7-1500 and ET 200SP controller families allows authenticated attac
Stored cross-site scripting in Siemens SIMATIC S7-1500 controller family web interface allows authenticated high-privile
Denial of service in Siemens industrial networking equipment allows remote unauthenticated attackers to crash affected d
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, Drive Controller and S7-1
Importing a maliciously crafted trace file into the integrated web server of a Siemens SIMATIC S7-1500 (and closely rela
Cross-site scripting (XSS) in Siemens SIMATIC S7-1500 PLC family firmware upload interface allows authenticated attacker
Stored cross-site scripting (CWE-79) in the integrated web server Trace page of Siemens SIMATIC S7-1500, ET 200SP, and S
Reflected cross-site scripting in the integrated web server of a broad range of Siemens SIMATIC S7-1500, ET 200SP, and D
Stored/DOM cross-site scripting (CWE-79, CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) in the web-based Trace
Cross-site scripting (CWE-79) in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Contr
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP and SIMATIC Drive Controll
Exploit-DB