EUVD-2026-98387
GHSA-739x-j4vq-qrx3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft CSV trace file with malicious signal names
-
ExploitSocial-engineer diagnostics user to import file
-
ExecutionError message renders unsanitized name on Trace page
-
ImpactJavaScript executes in victim's browser session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires three concrete conditions that are all stated or directly implied by the advisory: (1) the victim must be a logged-in user of the CPU's integrated web server who holds the specific 'Read diagnostics' function right; (2) the attacker must deliver a specially crafted CSV trace file whose calculated signal names contain JavaScript; and (3) the victim must be socially engineered into importing that file on the Trace page, where the unsanitized name is reflected in an error message. Limiting factors: the attack is not self-propagating, cannot fire against a default configuration without an authenticated privileged victim performing the import (UI:R), executes only in the context of that single victim's browser session, and yields only low confidentiality/integrity impact with no availability effect - substantially constraining real-world risk despite the network attack vector. |
| Impact | This is a medium-severity reflected cross-site scripting issue (CWE-79, CVSS 6.1) in the web interface of a broad range of Siemens SIMATIC S7-1500 / ET 200SP / Drive Controller CPUs. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows network reach and low attack complexity with no attacker privileges, but the mandatory UI:R and the description itself make clear that exploitation hinges on social-engineering a victim who must already be an authenticated operator holding the 'Read diagnostics' function right into importing a crafted CSV trace file. PR:N reflects that the attacker needs no account to author the malicious file, but the realistic barrier is high: a privileged human victim must be tricked, and impact is limited (C:L/I:L, A:N) to the victim's browser session. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a genuine but low-priority flaw - the high reach of AV:N is offset by the social-engineering requirement and privileged-victim precondition, placing it well below network-reachable unauthenticated RCE/KEV-class issues. The scope change (S:C) marginally raises the technical interest but does not change the operational verdict. |
| Exploit ScenarioDerived | An attacker crafts a CSV trace file containing calculated signal names embedded with malicious JavaScript and, via social engineering, convinces an engineer who holds the 'Read diagnostics' function right to import it on the device's Trace page. When the CPU's web server generates an error message echoing the unsanitized signal name, the attacker's script executes in the victim's authenticated browser session. No public exploit code is identified in the provided data; the low attack complexity (AC:L) is counterbalanced by the required user interaction (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Reflected cross-site scripting in the integrated web server of a broad range of Siemens SIMATIC S7-1500, ET 200SP, and Drive Controller CPU families allows attacker-controlled JavaScript to execute in the browser of an authenticated user who imports a crafted CSV trace file on the Trace page. The signal names inside the imported file are not sanitized before being echoed back into an error message, so the script runs in the context of that user's session, with the assessed impact limited to low confidentiality and low integrity (CVSS 3.1 base 6.1, CWE-79). Exploitation is not self-propagating and requires social engineering: the victim must hold the 'Read diagnostics' function right and must be persuaded to import the malicious trace file, since the CVSS vector specifies PR:N but UI:R, meaning no attacker credentials are needed while user interaction is mandatory; no public exploit code has been identified and the issue is not listed as actively exploited at time of analysis.
RemediationAI
No vendor-released patch version was identified in the available data, so the first action is to review Siemens ProductCERT advisory SSA-591731 (https://cert-portal.siemens.com/productcert/html/ssa-591731.html) and apply the firmware or software update listed there for each affected CPU or software-controller family once Siemens publishes it; because this is a firmware-resident web server issue, deployment requires a controlled PLC stop/restart or a software-controller upgrade window. Until a fix is applied, the most effective compensating control is to restrict or disable the integrated web server on every affected CPU: if diagnostics over the web interface are not operationally required, turn the web server off in the CPU configuration (trade-off: loss of browser-based diagnostics, trace retrieval, and online status views, forcing reliance on engineering-system access), and if it must remain enabled, restrict access to the diagnostics port to a dedicated management VLAN or a small set of engineering workstations via the CPU's built-in access protection and firewall rules (trade-off: legitimate remote diagnostics users must be re-onboarded and rules must be maintained). Additionally, review and minimize the assignment of the 'Read diagnostics' function right, since only users holding that right can be targeted by the import-based social-engineering vector, and pair this with user awareness guidance that trace CSV files should only be imported from trusted engineering sources. Note that because the payload is reflected in an error message rather than persisted, blocking outbound script execution in the browser (for example a strict Content-Security-Policy applied by a reverse proxy in front of the web server) reduces exploitability but does not correct the underlying missing output encoding and should be treated only as an interim hardening measure.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected devices are Siemens SIMATIC S7-1500 CPUs (including 1511, 1512C, 1513, 1515, 1516, 1517, 1518 and their F/T/TF/PRO variants), ET 200SP CPUs (1510SP, 1512SP, 1514SP, and the 1515SP PC open controller variants), Drive Controller CPUs 1504D TF and 1507D TF, the S7-1500 Software Controller (1507S/1508S, V2 through V4, including Linux variants), S7-PLCSIM Advanced, and the corresponding SIPLUS ruggedized SKUs. All of these platforms ship an integrated web server that exposes a diagnostics interface, including a Trace page used for importing and evaluating CSV trace recordings. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a reflected XSS variant: calculated signal names parsed out of the imported CSV are stored or carried through processing without HTML/JavaScript encoding and are later interpolated into an error message rendered on the Trace page. Because the error message responds to the import action, the injected payload is reflected back within the same request context, so any script executes with the origin, cookies, and privileges of the web server session rather than in a sandboxed context. The scope change (S:C) in the CVSS vector reflects the fact that the vulnerable component (the CSV parsing/diagnostics logic) and the impacted component (the user's browser session) differ.
Know when Simatic Et 200Sp Cpu 1510Sp F 1 Pn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Reflected XSS: attacker needs no account (PR:N) but victim must import the file (UI:R); script escapes the server into the browser session (S:C) with limited C/I impact and no availability loss.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
2DescriptionCVE.org
Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user’s browser session when the resulting error message is displayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Stored cross-site scripting (XSS) in Siemens SIMATIC S7-1500 and ET 200SP controller families allows authenticated attac
Stored cross-site scripting in Siemens SIMATIC S7-1500 controller family web interface allows authenticated high-privile
Denial of service in Siemens industrial networking equipment allows remote unauthenticated attackers to crash affected d
Cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPU
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, Drive Controller and S7-1
Importing a maliciously crafted trace file into the integrated web server of a Siemens SIMATIC S7-1500 (and closely rela
Cross-site scripting (XSS) in Siemens SIMATIC S7-1500 PLC family firmware upload interface allows authenticated attacker
Stored cross-site scripting (CWE-79) in the integrated web server Trace page of Siemens SIMATIC S7-1500, ET 200SP, and S
Stored/DOM cross-site scripting (CWE-79, CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) in the web-based Trace
Cross-site scripting (CWE-79) in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Contr
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP and SIMATIC Drive Controll
Exploit-DB