EUVD-2026-98381
GHSA-f4m3-j7vm-pp4x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft trace file with embedded JavaScript
-
ExploitSocial-engineer diagnostics-authorized user to import it
-
ExecutionScript executes in victim's web session
-
ImpactPerform unauthorized PLC operations as user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Eval input sanitization
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires ALL of the following: (1) the target CPU's integrated web server must be enabled; (2) an attacker-supplied, specially crafted trace file containing executable JavaScript; (3) a victim user who already holds the 'Read diagnostics' function right in the PLC's web server; and (4) that victim being successfully social-engineered into manually importing the malicious trace file (UI:A - active interaction). Executed operations are bounded by the victim's own authorization scope. Limiting factors that reduce realistic risk: the mandatory manual import step means no automatable or self-propagating exploitation, the victim must possess a specific diagnostics privilege, and the web server must be activated on the device - so default-hardened deployments with the web server disabled are not exploitable. |
| Impact | This is a genuine high-severity issue but NOT an imminent mass-exploitation threat. The CVSS 4.0 score of 9.4 (CRITICAL) is confirmed by Siemens advisory SSA-591731, with vector AV:N/AC:L/PR:N/UI:A and full High impact across both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H), reflecting that injected JavaScript can perform PLC operations through the integrated web server. However, the headline score is substantially tempered by real-world preconditions the vector encodes: UI:A (active user interaction) means the attack CANNOT self-propagate - it requires social-engineering a specific operator who already holds the 'Read diagnostics' function right into manually importing a crafted trace file. No EPSS probability, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization. The SSVC/exploitation signals therefore point to a targeted, operator-dependent attack rather than opportunistic scanning. Note a tension worth flagging: CVSS scores PR:N (attacker needs no privileges) yet the DESCRIPTION makes clear a privileged victim (diagnostics-authorized user) is mandatory for the chain to succeed - the privilege barrier lives on the victim side, not the attacker side, which the base score does not capture. Priority should be driven by whether the device's web server is exposed and how many trusted diagnostics operators exist, not by the raw 9.4 alone. |
| Exploit ScenarioDerived | An attacker crafts a trace file embedding malicious JavaScript and, via phishing or pretext, convinces a maintenance engineer who holds the 'Read diagnostics' right to import it through the PLC's integrated web server. On import, the script executes in the engineer's authenticated browser session and issues PLC operations within the scope of that engineer's authorization. No public exploit code is identified at time of analysis, and the attack cannot proceed without the victim's manual import action. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 13, 2026
Importing a maliciously crafted trace file into the integrated web server of a Siemens SIMATIC S7-1500 (and closely related ET 200SP, Drive Controller, Open Controller and S7-1500 Software Controller) CPU causes attacker-supplied JavaScript to execute inside the victim engineer's authenticated browser session and can issue PLC operations within that user's own authorization scope. Exploitation is not automated and not a mass-exploitation threat: it requires the CPU web server to be enabled, a victim who holds the 'Read diagnostics' function right, and successful social engineering into a manual file import (UI:A per the CVSS vector, which also carries PR:N, meaning the attacker needs no credentials of their own). The severity is high (CVSS 9.4 in the vendor's CVSS 4.0 assessment; our independent 3.1 assessment scores it AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), but this is a genuine high-severity issue rather than an imminent mass-exploitation threat - no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was provided in the source data.
Earlier versions of this analysis (1)
Imported diagnostic trace files are not stripped of executable content by the integrated web server on Siemens SIMATIC S7-1500, SIMATIC ET 200SP, SIMATIC Drive Controller and SIMATIC S7-1500 Software Controller / PLCSIM Advanced products, so a social-engineered operator can trigger attacker-controlled JavaScript inside their own browser session. Exploitation requires a human victim who holds the 'Read diagnostics' function right and who is persuaded to import a specially crafted trace file; once executed, the script performs PLC operations through the web server, but only within that user's authorization scope. Siemens ProductCERT assigns this a 9.6 Critical base score (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), driven by the mandatory user interaction and scope change rather than by any automatic or unauthenticated trigger; there is no CISA KEV listing, no EPSS score, and no public exploit code identified at time of analysis.
RemediationAI
No vendor-released patch version is identified in the available data, so treat the Siemens security advisory SSA-591731 (https://cert-portal.siemens.com/productcert/html/ssa-591731.html) as the authoritative source for fixed firmware versions and update the affected CPU, ET 200SP, Drive Controller, Open Controller, Software Controller and PLCSIM Advanced instances to the versions listed there; if that advisory specifies a fixed release, apply it as the primary fix. Where a firmware update cannot be deployed immediately, the highest-value compensating control is to disable the integrated web server on CPUs that do not require it (the device remains fully programmable and diagnosable through STEP 7/TIA Portal over the engineering interface) - the trade-off is loss of browser-based diagnostics and any web-based HMI/monitoring that depends on the server. If the web server must stay enabled, do not expose it to untrusted networks: block inbound reachability to its HTTP/HTTPS ports from anything except the engineering VLAN using the CPU's own firewall and cell-protection zones or an upstream industrial firewall, and avoid publishing it through NAT or remote-access gateways. Tighten the PLC web server access control so the 'Read diagnostics' function right is granted only to the smallest possible set of named engineers, since compromised script execution is bounded by that user's authorization scope, and audit/review existing web-server users. Finally, treat trace-file import as a privileged file-transfer operation: instruct engineers never to import trace files received by email, download or removable media unless their origin is verified, and consider requiring two-person review or scanning of trace files before import, acknowledging that this is a procedural control with no technical enforcement and depends on user compliance.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected devices are Siemens SIMATIC S7-1500 family controllers - including the standard 1511 through 1518 CPUs, their F (failsafe), T/TF (technology) and SIPLUS hardened variants, S7-1500 Software Controllers 1507S/1508S, SIMATIC S7-PLCSIM Advanced, the SIMATIC Drive Controller CPUs 1504D TF / 1507D TF, and ET 200SP CPUs 1510SP-1 PN, 1510SP F-1 PN, 1512SP-1 PN, 1512SP F-1 PN plus the ET 200SP Open Controller 1515SP PC - as reflected in the CPE entries and the long affected-product tag list. Many of these CPUs embed an integrated web server that exposes diagnostic pages and accepts trace files, which are normally used to capture and replay controller runtime diagnostics; the 'Read diagnostics' function right governs access to those pages. The root cause is CWE-95, Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'): the trace-file import path does not restrict executable content inside the imported file, so embedded JavaScript is parsed/rendered by the browser rather than treated as inert diagnostic data. Because the script executes in the origin of the controller's own web server and in the session of the importing user, it runs same-origin with the PLC web application and can drive the same web-server endpoints the victim is authorized to use, making this a classic stored/eval-style injection whose blast radius is bounded only by the victim's assigned privileges. The supplied CPE strings use wildcard versions, so the advisory (SSA-591731) should be consulted for the definitive firmware version matrix.
Know when Simatic Et 200Sp Cpu 1510Sp F 1 Pn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Attacker needs no privileges (PR:N) but victim interaction is mandatory (UI:R); injected JS crosses from browser to PLC via web server (S:C) with full C/I/A impact on PLC operations.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
2DescriptionCVE.org
Affected devices do not properly restrict executable content contained in imported trace files.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
Executive ViewAI
Siemens SIMATIC S7-1500 and related controller families (ET 200SP, Drive Controller, Open Controller, and S7-1500 Software Controller) are affected by a critical web server vulnerability that could let an attacker execute JavaScript in an engineer's browser session and perform PLC operations within that user's rights. Exploitation requires user interaction and a targeted social engineering step rather than mass scanning, and there is no public exploit identified at time of analysis, but the operational risk in industrial control environments warrants management attention. Leadership should prioritize reducing exposed web servers, enforcing least privilege, and preparing for a vendor patch.
No vendor-released patch identified at time of analysis. Interim mitigations: disable the integrated web server on affected Siemens SIMATIC S7-1500, ET 200SP, Drive Controller, Open Controller, and S7-1500 Software Controller CPUs where operationally feasible; if the web server must remain enabled, restrict access to trusted management networks with strict firewall rules and jump hosts, enforce least privilege for the 'Read diagnostics' function right, block or inspect trace-file imports, and train engineers not to open trace files from untrusted sources. Monitor Siemens advisory for updates.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Stored cross-site scripting (XSS) in Siemens SIMATIC S7-1500 and ET 200SP controller families allows authenticated attac
Stored cross-site scripting in Siemens SIMATIC S7-1500 controller family web interface allows authenticated high-privile
Denial of service in Siemens industrial networking equipment allows remote unauthenticated attackers to crash affected d
Cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPU
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, Drive Controller and S7-1
Cross-site scripting (XSS) in Siemens SIMATIC S7-1500 PLC family firmware upload interface allows authenticated attacker
Stored cross-site scripting (CWE-79) in the integrated web server Trace page of Siemens SIMATIC S7-1500, ET 200SP, and S
Reflected cross-site scripting in the integrated web server of a broad range of Siemens SIMATIC S7-1500, ET 200SP, and D
Stored/DOM cross-site scripting (CWE-79, CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) in the web-based Trace
Cross-site scripting (CWE-79) in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Contr
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP and SIMATIC Drive Controll
Exploit-DB