Which versions of SIMATIC S7-1500 are affected by EUVD-2026-29426?

Siemens SIMATIC S7-1500 controllers contain a stored cross-site scripting vulnerability (CVSS 9.3) in the web interface that allows authenticated high-privilege users to inject malicious code through…

How to fix or mitigate EUVD-2026-29426?

Within 24 hours: Identify all SIMATIC S7-1500 controllers in production and document which users have upload/project-creation privileges; restrict project file upload capabilities to verified engineering staff only and disable web interface access for non-essential users. Within 7 days: Implement network segmentation isolating S7-1500 web interfaces to engineering VLANs with strict access controls; audit all existing project files for suspicious PLC/station naming patterns; enable web interface logging and centralize logs to SIEM. Within 30 days: Develop and test backup procedures to isolate infected projects; establish code review process for project files before deployment; contact Siemens support for patch timeline and escalate to OT security team for compensating control options specific to your S7-1500 firmware versions.

SIMATIC S7-1500 EUVD-2026-29426

Q: What is the CVSS score of EUVD-2026-29426?

EUVD-2026-29426 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-25786 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-05-12 siemens

9.3

CVSS 4.0 · Vendor: siemens

Severity by source

Vendor (siemens) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (siemens) · only source for this CVE.

CVSS VectorVendor: siemens

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

May 12, 2026 - 10:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 12, 2026 - 10:22 vuln.today

cvss_changed

CVSS changed

May 12, 2026 - 10:22 NVD

9.1 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

May 12, 2026 - 10:02 vuln.today

CVE Published

May 12, 2026 - 08:20 nvd

CRITICAL 9.1

DescriptionCVE.org

Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page. If a benign user with appropriate rights accesses the "communication" parameters page, the malicious code would be executed in the scope of their web session.

AnalysisAI

Stored cross-site scripting in Siemens SIMATIC S7-1500 controller family web interface allows authenticated high-privilege attackers to inject malicious code via crafted PLC/station names in TIA project files. When users with appropriate rights later access the communication parameters page, injected scripts execute in their session context with high impact to confidentiality, integrity, and availability across system boundaries (CVSS 9.3, CVSS:4.0 S:H). No public exploit identified at time of analysis, but CVSS vector indicates low attack complexity (AC:L) once attacker gains privileged project upload access.

Technical ContextAI

This is a stored/persistent XSS vulnerability (CWE-79) affecting the web-based management interface of Siemens SIMATIC S7-1500 programmable logic controllers, SIMATIC ET 200SP CPUs, Drive Controllers, Software Controllers, and S7-PLCSIM Advanced simulation software. The affected products use TIA Portal (Totally Integrated Automation Portal) for engineering and configuration. When project configurations containing PLC or station names are downloaded to the device, these names are rendered on the 'communication' parameters page without proper sanitization. The vulnerability stems from inadequate input validation of user-supplied metadata fields in TIA project files. The CVSS 4.0 vector SC:H/SI:H/SA:H indicates exploitation can compromise confidentiality, integrity, and availability of subsequent system components beyond the vulnerable web interface itself, suggesting potential lateral movement or session hijacking scenarios within industrial control networks.

RemediationAI

Apply firmware updates per Siemens ProductCERT advisory SSA-688146 (https://cert-portal.siemens.com/productcert/html/ssa-688146.html). Based on EUVD version data, fixed firmware versions include V2.9.9 or later for S7-1500 CPU 151x-1PN models, ET 200SP 1510/1512SP variants, and 1511C/1512C compact CPUs; V3.1.6 or later for S7-1500 CPU 1516/1517/1518 -3PN/DP and -4PN/DP models and Drive Controller 1504D/1507D TF variants. For product lines showing open-ended vulnerability ranges, contact Siemens support to confirm patch availability and compatibility with existing TIA Portal projects. Compensating controls until patching: restrict TIA Portal project download permissions to verified personnel only via role-based access control; implement mandatory code review of all TIA project files before deployment using static analysis tools to detect suspicious scripting in metadata fields; isolate engineering workstations accessing PLC web interfaces on dedicated VLANs without internet access; disable web server functionality on PLCs if HMI/SCADA provides sufficient monitoring (note: this prevents local diagnostics and may complicate troubleshooting); log all access to communication parameter pages and correlate with authorized maintenance windows to detect post-compromise reconnaissance. Trade-off: disabling web interface eliminates attack surface but requires alternative remote access methods (TIA Portal direct connection) increasing operational overhead.