Element maps-ng CVE-2026-66155

Exploitation requires the victim to be using an affected version of Siemens Element maps-ng (V47 < V47.12.3, V48 < V48.11.3, or V49 < V49.16.1) and to have the application loaded in a browser session. The CVSS vector's PR:L indicates the victim (or attacker) must have some authenticated or low-privilege access to the application. The attacker must be able to deliver a crafted URL to the victim - either via phishing, a shared link, or another social engineering vector. Crucially, exploitation is not triggered on page load alone; the victim must hover the mouse over a map pin to cause tooltip rendering, which is the precise moment of script injection. This hover-to-trigger condition limits both opportunistic and automated exploitation. The vulnerability does not affect users who do not interact with map pin tooltips, and is not exploitable against default configurations in isolation without URL delivery to an active session.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N) scores at 7.0, reflecting network reachability, low complexity, low-privilege access, and a passive user interaction requirement (hovering over a pin). The VC:H rating suggests the vendor assesses that session-level data exposed through this Siemens operational interface carries high confidentiality value - plausible for industrial dashboards displaying facility or infrastructure data. PR:L indicates the attacker must possess some level of authenticated access or be able to deliver the crafted URL to an authenticated victim. The mandatory hover interaction (UI:P) is a meaningful friction point that limits opportunistic mass exploitation. No EPSS score was provided and no KEV listing exists, and no public proof-of-concept was identified, all of which lower real-world urgency compared to the CVSS score alone. Overall, this is a genuine security concern for organizations running Siemens Element maps-ng in environments where the web interface is accessible and holds sensitive operational data, but is not an immediate mass-exploitation priority.

An attacker with low-level access to the application - or able to phish a victim who holds such access - constructs a URL pointing to the Element maps-ng interface with a JavaScript payload embedded in the points property that controls tooltip label rendering. The victim navigates to the link while authenticated and moves the cursor over a map pin, causing the browser to render the tooltip and execute the injected script, potentially harvesting session cookies, credentials, or operational data visible in the current session. No public proof-of-concept has been identified, but the attack technique is well-understood and straightforward for any attacker familiar with reflected XSS.