Simatic Et 200Sp Open Controller Cpu 1515Sp Pc2 Incl Siplus Variants V3 Cpus Windows Os
Monthly
Cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPU families allows an attacker to have malicious JavaScript run in the browser session of a plant engineer who imports a booby-trapped CSV trace file. The flaw is CWE-79: visual-marker data inside imported CSV trace files is not validated or sanitized before it is rendered on the controller's Trace page, so script embedded in that field executes in the web-server origin once the file is opened. Exploitation is not autonomous - per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) it is unauthenticated at the network layer but requires user interaction (UI:R) and a victim holding the 'Read diagnostics' function right, and the resulting script can perform PLC operations through the web server limited to that user's authorization; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). The severity is high (CVSS 4.0 base 9.4; assessed 3.1 10.0 with scope change) because a successful script can reach high-integrity PLC operations from the controller's own trusted web session.
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, Drive Controller and S7-1500 Software Controller CPUs lets attacker-controlled JavaScript execute in a privileged operator's browser session after that user is social-engineered into importing a crafted trace file and its unsanitized comment fields are rendered on the Trace page (reported CVSS 4.0 base 9.4; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Because the script runs inside the victim's authenticated session, it can perform PLC operations through the same web server within the scope of that user's authorization, so impact is bounded by the victim's privileges rather than by the attacker's. Exploitation is gated by user interaction and by a reachable/enabled CPU web server, and the victim must already hold the 'Read diagnostics' function right; no public exploit code or CISA KEV entry is associated with this CVE in the available data (no public exploit identified at time of analysis).
Importing a maliciously crafted trace file into the integrated web server of a Siemens SIMATIC S7-1500 (and closely related ET 200SP, Drive Controller, Open Controller and S7-1500 Software Controller) CPU causes attacker-supplied JavaScript to execute inside the victim engineer's authenticated browser session and can issue PLC operations within that user's own authorization scope. Exploitation is not automated and not a mass-exploitation threat: it requires the CPU web server to be enabled, a victim who holds the 'Read diagnostics' function right, and successful social engineering into a manual file import (UI:A per the CVSS vector, which also carries PR:N, meaning the attacker needs no credentials of their own). The severity is high (CVSS 9.4 in the vendor's CVSS 4.0 assessment; our independent 3.1 assessment scores it AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), but this is a genuine high-severity issue rather than an imminent mass-exploitation threat - no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was provided in the source data.
Stored cross-site scripting (CWE-79) in the integrated web server Trace page of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPUs allows attacker-supplied JavaScript embedded in a crafted calculated-signal file to execute in the browser session of a user who holds the 'Read diagnostics' function right, after that user is socially engineered into importing the file. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1 medium), the attacker is unauthenticated at the network layer but must rely on the victim performing a manual import, and the resulting script can drive PLC operations through the web server only within that user's existing authorization scope. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so exploitation is not confirmed as active; the practical risk is concentrated in environments where the PLC web server is exposed and diagnostic staff routinely import calculated-signal files.
Reflected cross-site scripting in the integrated web server of a broad range of Siemens SIMATIC S7-1500, ET 200SP, and Drive Controller CPU families allows attacker-controlled JavaScript to execute in the browser of an authenticated user who imports a crafted CSV trace file on the Trace page. The signal names inside the imported file are not sanitized before being echoed back into an error message, so the script runs in the context of that user's session, with the assessed impact limited to low confidentiality and low integrity (CVSS 3.1 base 6.1, CWE-79). Exploitation is not self-propagating and requires social engineering: the victim must hold the 'Read diagnostics' function right and must be persuaded to import the malicious trace file, since the CVSS vector specifies PR:N but UI:R, meaning no attacker credentials are needed while user interaction is mandatory; no public exploit code has been identified and the issue is not listed as actively exploited at time of analysis.
Stored/DOM cross-site scripting (CWE-79, CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) in the web-based Trace page of Siemens SIMATIC S7-1500, ET 200SP and Drive Controller CPUs allows attacker-controlled JavaScript to run in an authenticated user's browser session when signal names taken from an imported CSV trace file are rendered unsanitized in Trace page selection menus. The attack is not self-triggering: an attacker must first socially engineer a user who holds the 'Read diagnostics' function right into importing a crafted trace file through the built-in CSV import feature, and execution occurs only when that victim subsequently interacts with an affected selection menu, so impact is confined to the victim's authenticated session with low confidentiality and integrity effects and no availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and there is no path for an unauthenticated remote attacker to trigger the flaw without victim interaction.
Cross-site scripting (CWE-79) in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPUs allows attacker-controlled JavaScript to run in an operator's browser when a crafted CSV trace file is imported and its calculated signal data is rendered on the Trace page. Exploitation is not automatic: an attacker must socially engineer a user who already holds the 'Read diagnostics' function right into importing the malicious file, and the injected script then executes within that user's session and can drive PLC operations through the web server, limited to that user's authorization scope. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1) reflects that access is remote over the network but requires victim interaction; there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP and SIMATIC Drive Controller CPUs allows an attacker to bury JavaScript inside the visual properties of calculated signals in a crafted CSV trace file, which then executes in the browser session of anyone who imports that file and opens the Trace page. Exploitation is neither remote nor automatic: the CPU web server must be enabled and reachable, and a social-engineered operator holding the 'Read diagnostics' function right must import the file (CVSS 6.1, UI:R, PR:N), after which any resulting PLC operations are confined to that operator's own authorization scope. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPU families allows an attacker to have malicious JavaScript run in the browser session of a plant engineer who imports a booby-trapped CSV trace file. The flaw is CWE-79: visual-marker data inside imported CSV trace files is not validated or sanitized before it is rendered on the controller's Trace page, so script embedded in that field executes in the web-server origin once the file is opened. Exploitation is not autonomous - per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) it is unauthenticated at the network layer but requires user interaction (UI:R) and a victim holding the 'Read diagnostics' function right, and the resulting script can perform PLC operations through the web server limited to that user's authorization; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). The severity is high (CVSS 4.0 base 9.4; assessed 3.1 10.0 with scope change) because a successful script can reach high-integrity PLC operations from the controller's own trusted web session.
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, Drive Controller and S7-1500 Software Controller CPUs lets attacker-controlled JavaScript execute in a privileged operator's browser session after that user is social-engineered into importing a crafted trace file and its unsanitized comment fields are rendered on the Trace page (reported CVSS 4.0 base 9.4; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Because the script runs inside the victim's authenticated session, it can perform PLC operations through the same web server within the scope of that user's authorization, so impact is bounded by the victim's privileges rather than by the attacker's. Exploitation is gated by user interaction and by a reachable/enabled CPU web server, and the victim must already hold the 'Read diagnostics' function right; no public exploit code or CISA KEV entry is associated with this CVE in the available data (no public exploit identified at time of analysis).
Importing a maliciously crafted trace file into the integrated web server of a Siemens SIMATIC S7-1500 (and closely related ET 200SP, Drive Controller, Open Controller and S7-1500 Software Controller) CPU causes attacker-supplied JavaScript to execute inside the victim engineer's authenticated browser session and can issue PLC operations within that user's own authorization scope. Exploitation is not automated and not a mass-exploitation threat: it requires the CPU web server to be enabled, a victim who holds the 'Read diagnostics' function right, and successful social engineering into a manual file import (UI:A per the CVSS vector, which also carries PR:N, meaning the attacker needs no credentials of their own). The severity is high (CVSS 9.4 in the vendor's CVSS 4.0 assessment; our independent 3.1 assessment scores it AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), but this is a genuine high-severity issue rather than an imminent mass-exploitation threat - no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was provided in the source data.
Stored cross-site scripting (CWE-79) in the integrated web server Trace page of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPUs allows attacker-supplied JavaScript embedded in a crafted calculated-signal file to execute in the browser session of a user who holds the 'Read diagnostics' function right, after that user is socially engineered into importing the file. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1 medium), the attacker is unauthenticated at the network layer but must rely on the victim performing a manual import, and the resulting script can drive PLC operations through the web server only within that user's existing authorization scope. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so exploitation is not confirmed as active; the practical risk is concentrated in environments where the PLC web server is exposed and diagnostic staff routinely import calculated-signal files.
Reflected cross-site scripting in the integrated web server of a broad range of Siemens SIMATIC S7-1500, ET 200SP, and Drive Controller CPU families allows attacker-controlled JavaScript to execute in the browser of an authenticated user who imports a crafted CSV trace file on the Trace page. The signal names inside the imported file are not sanitized before being echoed back into an error message, so the script runs in the context of that user's session, with the assessed impact limited to low confidentiality and low integrity (CVSS 3.1 base 6.1, CWE-79). Exploitation is not self-propagating and requires social engineering: the victim must hold the 'Read diagnostics' function right and must be persuaded to import the malicious trace file, since the CVSS vector specifies PR:N but UI:R, meaning no attacker credentials are needed while user interaction is mandatory; no public exploit code has been identified and the issue is not listed as actively exploited at time of analysis.
Stored/DOM cross-site scripting (CWE-79, CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) in the web-based Trace page of Siemens SIMATIC S7-1500, ET 200SP and Drive Controller CPUs allows attacker-controlled JavaScript to run in an authenticated user's browser session when signal names taken from an imported CSV trace file are rendered unsanitized in Trace page selection menus. The attack is not self-triggering: an attacker must first socially engineer a user who holds the 'Read diagnostics' function right into importing a crafted trace file through the built-in CSV import feature, and execution occurs only when that victim subsequently interacts with an affected selection menu, so impact is confined to the victim's authenticated session with low confidentiality and integrity effects and no availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and there is no path for an unauthenticated remote attacker to trigger the flaw without victim interaction.
Cross-site scripting (CWE-79) in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPUs allows attacker-controlled JavaScript to run in an operator's browser when a crafted CSV trace file is imported and its calculated signal data is rendered on the Trace page. Exploitation is not automatic: an attacker must socially engineer a user who already holds the 'Read diagnostics' function right into importing the malicious file, and the injected script then executes within that user's session and can drive PLC operations through the web server, limited to that user's authorization scope. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1) reflects that access is remote over the network but requires victim interaction; there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP and SIMATIC Drive Controller CPUs allows an attacker to bury JavaScript inside the visual properties of calculated signals in a crafted CSV trace file, which then executes in the browser session of anyone who imports that file and opens the Trace page. Exploitation is neither remote nor automatic: the CPU web server must be enabled and reachable, and a social-engineered operator holding the 'Read diagnostics' function right must import the file (CVSS 6.1, UI:R, PR:N), after which any resulting PLC operations are confined to that operator's own authorization scope. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.