EUVD-2026-98388
GHSA-7372-jr4h-6q2x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious calculated-signal file
-
DeliverySocial-engineer diagnostics-authorized user to import it
-
ExploitUnsanitized data rendered on Trace page
-
ExecutionAttacker JavaScript executes in victim session
-
ImpactPerform PLC operations within user's authorization
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the device's integrated web server and Trace page to be reachable and in use, and specifically requires a victim user who holds the 'Read diagnostics' function right to be socially engineered into importing an attacker-crafted calculated-signal file (UI:R). The limiting factors are significant: the attacker cannot trigger this directly or remotely against a default configuration - it depends on a privileged user performing a manual import action, so successful attacks rely on social engineering plus an account with diagnostics rights. Impact is bounded to PLC operations within that user's existing authorization scope. |
| Impact | This is a reflected/stored cross-site scripting flaw (CWE-79) in the Trace page of Siemens SIMATIC S7-1500 / ET 200SP / Drive Controller CPU web servers, carrying a vendor CVSS 3.1 base score of 6.1 (medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The signals point to a genuine but conditional, lower-tier risk rather than a drop-everything priority. There is no EPSS score, no CISA KEV listing, and no public exploit in the provided data (no public exploit identified at time of analysis), so there is no evidence of active or automatable exploitation. The CVSS vector encodes PR:N (so, per the precision rules, unauthenticated from the attacker's perspective), but this is nuanced: the description makes clear the attacker does NOT interact with the device directly - exploitation hinges on social-engineering a legitimate user who already holds the 'Read diagnostics' function right into importing a malicious calculated-signal file (UI:R). The scope change (S:C) and the ability to 'perform PLC operations within the scope of the user's authorization' are what make this more than a cosmetic XSS, because the injected script can act on an OT controller. No SSVC decision data, EPSS probability, or POC status was supplied, so automatability and real-world exploitation likelihood cannot be derived from the input and should be verified against the Siemens advisory (SSA-591731). |
| Exploit ScenarioDerived | An attacker crafts a malicious calculated-signal file embedding JavaScript and, through social engineering (e.g., a support pretext or a shared diagnostics bundle), convinces an operator who holds the 'Read diagnostics' function right to import it on the device's Trace page. When the page renders the unsanitized signal data, the attacker's JavaScript executes in the victim's authenticated browser session and can issue PLC operations within that user's authorization. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Stored cross-site scripting (CWE-79) in the integrated web server Trace page of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPUs allows attacker-supplied JavaScript embedded in a crafted calculated-signal file to execute in the browser session of a user who holds the 'Read diagnostics' function right, after that user is socially engineered into importing the file. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1 medium), the attacker is unauthenticated at the network layer but must rely on the victim performing a manual import, and the resulting script can drive PLC operations through the web server only within that user's existing authorization scope. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so exploitation is not confirmed as active; the practical risk is concentrated in environments where the PLC web server is exposed and diagnostic staff routinely import calculated-signal files.
RemediationAI
Apply the firmware updates specified in the Siemens security advisory SSA-591731 (https://cert-portal.siemens.com/productcert/html/ssa-591731.html), which is the authoritative source for the exact fixed CPU/Software Controller/PLCSIM Advanced versions for each affected article number-patch status was not independently confirmed from the supplied CVE data, so verify the fixed release against that advisory before rollout. Where immediate upgrade is not possible, the highest-value compensating control is to reduce exposure of the integrated web server: disable the CPU web server entirely where it is not operationally required (this removes the Trace page as an attack surface but also removes browser-based diagnostics and any remote monitoring that depends on it), or, if the web server must stay enabled, restrict reachability to a dedicated engineering/diagnostic subnet via firewall rules and block TCP 80/443 from untrusted or enterprise-wide networks (side effect: diagnostic staff must connect from the protected zone). Tighten the 'Read diagnostics' function right so that only the minimum required personnel can import calculated-signal files, since the attack depends on a user with that right performing the import; additionally, treat calculated-signal files as untrusted input and only import files from known, integrity-checked sources (side effect: legitimate diagnostic workflows require provenance verification). Siemens' general operational guidelines for industrial security-network segmentation, defense-in-depth, and restricting access to the CPU web interface-remain relevant supporting controls. Detection should focus on Trace page imports by users holding diagnostics rights and on unexpected browser-session activity reaching the CPU web server; note that because the payload executes in the victim's own authenticated session, server-side logging of the injected request may appear as legitimate traffic.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-79 cross-site scripting condition arising from missing output encoding/sanitization on the Trace page of the SIMATIC CPU integrated web server. The Trace feature ingests 'calculated signal' files-diagnostic/measurement data produced and exchanged by engineering tooling-and the CPU-side web application renders fields from those files into the Trace page HTML without properly sanitizing the calculated signal data first. Because the injected payload originates from a persisted file rather than a request parameter, the script is stored in the context of the diagnostic trace and executes in the origin of the PLC's web server whenever the page is viewed, which is why the CVSS vector carries S:C (scope change) and C:L/I:L: the script runs with the web application's origin privileges and can issue authenticated requests on behalf of the victim. CPE data confirms the affected platform is the SIMATIC S7-1500 CPU family and its derivatives, specifically cpe:2.3:a:siemens:simatic_drive_controller_cpu_1504d_tf, ...:simatic_drive_controller_cpu_1507d_tf, and ...:simatic_et_200sp_cpu_1510sp_f-1_pn, ...:1510sp-1_pn, ...:1512sp_f-1_pn and ...:1512sp-1_pn, all with version wildcards; the vendor advisory tag set extends this to the wider S7-1500 CPU portfolio (1511 through 1518 variants, including F/T/TF safety and technology CPUs), ET 200SP and ET 200SP Open Controller CPUs, S7-1500 Software Controller V2-V4 including the Linux V2/V3 builds, S7-PLCSIM Advanced, and corresponding SIPLUS variants. The web server and Trace page must be reachable and in use for the condition to be exploitable.
Know when Simatic Et 200Sp Cpu 1510Sp F 1 Pn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
PR:N as the attacker needs no account, but UI:R because a privileged victim must import the crafted file; S:C since injected script acts via the web server to perform PLC operations beyond the browser, with low C/I and no availability impact.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
2DescriptionCVE.org
Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Stored cross-site scripting (XSS) in Siemens SIMATIC S7-1500 and ET 200SP controller families allows authenticated attac
Stored cross-site scripting in Siemens SIMATIC S7-1500 controller family web interface allows authenticated high-privile
Denial of service in Siemens industrial networking equipment allows remote unauthenticated attackers to crash affected d
Cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPU
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, Drive Controller and S7-1
Importing a maliciously crafted trace file into the integrated web server of a Siemens SIMATIC S7-1500 (and closely rela
Cross-site scripting (XSS) in Siemens SIMATIC S7-1500 PLC family firmware upload interface allows authenticated attacker
Reflected cross-site scripting in the integrated web server of a broad range of Siemens SIMATIC S7-1500, ET 200SP, and D
Stored/DOM cross-site scripting (CWE-79, CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) in the web-based Trace
Cross-site scripting (CWE-79) in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Contr
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP and SIMATIC Drive Controll
Exploit-DB