EUVD-2026-98386
GHSA-gqqx-3f3w-hqvf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft CSV trace file with scripted signal name
-
DeliverySocial-engineer diagnostics user to import file
-
ExploitVictim opens affected selection menu
-
ExecutionUnsanitized signal name renders in browser
-
ImpactJavaScript executes in authenticated session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target device's web Trace page and its CSV trace-file import feature are in use, and that the attacker can induce a victim who holds the 'Read diagnostics' function right to import a specially crafted trace file (UI:R). The payload only triggers when the victim subsequently interacts with an affected selection menu on the Trace page. Limiting factors: the victim must be an authenticated user with a specific diagnostic privilege, the attack depends on successful social engineering to deliver the malicious file, and impact is confined to the victim's authenticated browser session (C:L/I:L, no availability impact). There is no path for a fully unauthenticated remote attacker to self-trigger execution. |
| Impact | This is a moderate-severity stored/DOM cross-site scripting issue (CWE-79, CVSS 6.1) in the web-based Trace page of Siemens SIMATIC S7-1500 / ET 200SP / Drive Controller CPUs, where signal names from imported CSV trace files are rendered unsanitized in selection menus. The Siemens CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects low confidentiality and integrity impact with a scope change (script executes in the victim's browser authority), and critically depends on user interaction (UI:R): a victim holding the 'Read diagnostics' function right must be social-engineered into importing an attacker-crafted file. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is not a drop-everything priority. The PR:N rating models the attacker's own lack of privileges, but real-world exploitation is materially gated because the victim must be an authenticated operator with diagnostic rights who is tricked into loading a malicious trace file; this social-engineering and privileged-victim dependency, combined with the limited C:L/I:L impact confined to a browser session, places this well below network-reachable unauthenticated RCE despite the AV:N label. Note a mild tension: although rated AV:N, exploitation hinges on a local file-import workflow rather than a direct remote payload, so the network vector is better understood as 'victim's browser reachable over the engineering/diagnostic web interface' - verify the exposure of that interface in the target environment. |
| Exploit ScenarioDerived | An attacker crafts a CSV trace file containing a malicious JavaScript payload embedded in a signal name and, via phishing or pretexting, persuades an operator with the 'Read diagnostics' function right to import it on the CPU's Trace page. When the operator later opens an affected selection menu, the stored signal name is rendered without sanitization and the attacker's script executes in the authenticated browser session. No public exploit code or active exploitation has been identified, so this requires the attacker to develop the payload and successfully social-engineer a privileged user. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Stored/DOM cross-site scripting (CWE-79, CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) in the web-based Trace page of Siemens SIMATIC S7-1500, ET 200SP and Drive Controller CPUs allows attacker-controlled JavaScript to run in an authenticated user's browser session when signal names taken from an imported CSV trace file are rendered unsanitized in Trace page selection menus. The attack is not self-triggering: an attacker must first socially engineer a user who holds the 'Read diagnostics' function right into importing a crafted trace file through the built-in CSV import feature, and execution occurs only when that victim subsequently interacts with an affected selection menu, so impact is confined to the victim's authenticated session with low confidentiality and integrity effects and no availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and there is no path for an unauthenticated remote attacker to trigger the flaw without victim interaction.
RemediationAI
The provided intelligence does not include an exact vendor fix version, so no patched release can be cited here: treat this as no vendor-released patch identified at time of analysis and consult Siemens ProductCERT advisory SSA-591731 (https://cert-portal.siemens.com/productcert/html/ssa-591731.html) for the applicable firmware/update for each specific CPU and Software Controller/PLCSIM Advanced variant before making any version claim. Until an update is applied, the most effective compensating control is to remove or tightly restrict the 'Read diagnostics' function right so that only strictly trusted, vetted personnel can reach the Trace page and its CSV import feature, since the flaw cannot be triggered without a privileged victim importing a crafted file; this reduces the attack surface but also limits legitimate diagnostic workflows for other staff. Operationally, enforce a policy that CSV trace files are imported only from internally generated, trusted sources, and treat any externally supplied trace file as untrusted; scanning or manual inspection of signal-name fields for script content before import adds friction but blocks the delivery step of the social-engineering chain. Additional hardening with trade-offs includes restricting access to the controller web interface to a dedicated engineering VLAN with authenticated jump hosts (reduces reachability but complicates remote maintenance), and using a hardened/less permissive browser profile or isolated browser session for engineering access to the device web UI to contain any script that does execute. Note that browser-side mitigations and network controls do not fix the underlying unsanitized rendering and are not substitutes for the vendor firmware update.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is improper neutralization of user-controllable input during web page generation (CWE-79): the affected devices' web interface accepts imported CSV trace files and uses the signal names contained in them to populate selection menus on the Trace page without sanitizing or encoding those names. Because the tainted values are rendered back into the engineering/diagnostics web UI, this is effectively a stored XSS condition, with the victim's browser treating the injected JavaScript as part of the trusted device web application. The CVSS vector shows S:C (scope changed), which reflects that the injected script executes in the context of the victim's session against the device web UI rather than within the narrower security scope of the injection source; C:L/I:L and A:N bound the practical impact to limited session-level data exposure and manipulation with no denial of service. The affected technology stack is Siemens SIMATIC controller web servers on S7-1500 family CPUs, SIMATIC ET 200SP (including the 1510SP/1512SP/1514SP, F-variants, SPT variants and Open Controller 1515SP PC/PC2/PC3 units), SIMATIC Drive Controller CPUs 1504D TF and 1507D TF, SIMATIC S7-1500 Software Controller (1507S/1508S, Linux V2/V3) and SIMATIC S7 PLCSIM Advanced, plus the corresponding SIPLUS variants, as enumerated in the supplied CPE data (e.g. cpe:2.3:a:siemens:simatic_drive_controller_cpu_1504d_tf, cpe:2.3:a:siemens:simatic_et_200sp_cpu_1510sp_f-1_pn, cpe:2.3:a:siemens:simatic_et_200sp_cpu_1512sp-1_pn). The involvement of an industrial control product means the browser session reached by the injected script may carry diagnostic and engineering privileges, which is why the vendor and the assessment emphasize the specific 'Read diagnostics' function right as a prerequisite.
Know when Simatic Et 200Sp Cpu 1510Sp F 1 Pn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Attacker needs no privileges (PR:N) but requires victim interaction importing a file (UI:R); script runs in the browser's separate authority (S:C) with limited C/I and no availability impact.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
2DescriptionCVE.org
Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user’s browser session when the user subsequently interacts with an affected selection menu.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Stored cross-site scripting (XSS) in Siemens SIMATIC S7-1500 and ET 200SP controller families allows authenticated attac
Stored cross-site scripting in Siemens SIMATIC S7-1500 controller family web interface allows authenticated high-privile
Denial of service in Siemens industrial networking equipment allows remote unauthenticated attackers to crash affected d
Cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPU
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, Drive Controller and S7-1
Importing a maliciously crafted trace file into the integrated web server of a Siemens SIMATIC S7-1500 (and closely rela
Cross-site scripting (XSS) in Siemens SIMATIC S7-1500 PLC family firmware upload interface allows authenticated attacker
Stored cross-site scripting (CWE-79) in the integrated web server Trace page of Siemens SIMATIC S7-1500, ET 200SP, and S
Reflected cross-site scripting in the integrated web server of a broad range of Siemens SIMATIC S7-1500, ET 200SP, and D
Cross-site scripting (CWE-79) in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Contr
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP and SIMATIC Drive Controll
Exploit-DB