Simatic S7 Plcsim Advanced
Monthly
Cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPU families allows an attacker to have malicious JavaScript run in the browser session of a plant engineer who imports a booby-trapped CSV trace file. The flaw is CWE-79: visual-marker data inside imported CSV trace files is not validated or sanitized before it is rendered on the controller's Trace page, so script embedded in that field executes in the web-server origin once the file is opened. Exploitation is not autonomous - per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) it is unauthenticated at the network layer but requires user interaction (UI:R) and a victim holding the 'Read diagnostics' function right, and the resulting script can perform PLC operations through the web server limited to that user's authorization; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). The severity is high (CVSS 4.0 base 9.4; assessed 3.1 10.0 with scope change) because a successful script can reach high-integrity PLC operations from the controller's own trusted web session.
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, Drive Controller and S7-1500 Software Controller CPUs lets attacker-controlled JavaScript execute in a privileged operator's browser session after that user is social-engineered into importing a crafted trace file and its unsanitized comment fields are rendered on the Trace page (reported CVSS 4.0 base 9.4; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Because the script runs inside the victim's authenticated session, it can perform PLC operations through the same web server within the scope of that user's authorization, so impact is bounded by the victim's privileges rather than by the attacker's. Exploitation is gated by user interaction and by a reachable/enabled CPU web server, and the victim must already hold the 'Read diagnostics' function right; no public exploit code or CISA KEV entry is associated with this CVE in the available data (no public exploit identified at time of analysis).
Importing a maliciously crafted trace file into the integrated web server of a Siemens SIMATIC S7-1500 (and closely related ET 200SP, Drive Controller, Open Controller and S7-1500 Software Controller) CPU causes attacker-supplied JavaScript to execute inside the victim engineer's authenticated browser session and can issue PLC operations within that user's own authorization scope. Exploitation is not automated and not a mass-exploitation threat: it requires the CPU web server to be enabled, a victim who holds the 'Read diagnostics' function right, and successful social engineering into a manual file import (UI:A per the CVSS vector, which also carries PR:N, meaning the attacker needs no credentials of their own). The severity is high (CVSS 9.4 in the vendor's CVSS 4.0 assessment; our independent 3.1 assessment scores it AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), but this is a genuine high-severity issue rather than an imminent mass-exploitation threat - no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was provided in the source data.
Cross-site scripting (XSS) in Siemens SIMATIC S7-1500 PLC family firmware upload interface allows authenticated attackers to execute malicious JavaScript in administrator sessions via crafted filenames. This stored XSS requires social engineering to trick authenticated users into selecting the attacker-supplied firmware file on the web-based management interface. Successful exploitation enables session hijacking and credential theft without requiring the malicious file to be uploaded. EPSS data not provided, no CISA KEV status confirmed, affecting industrial automation controllers widely deployed in critical infrastructure environments.
Stored cross-site scripting (XSS) in Siemens SIMATIC S7-1500 and ET 200SP controller families allows authenticated attackers with high privileges to inject malicious scripts via Technology Object (TO) names when downloading TIA Portal projects. The scripts execute when authorized users access the Motion Control Diagnostics web interface page, enabling session hijacking, credential theft, or privileged actions performed under the victim's context. This affects over 100 product variants across industrial automation controllers, software controllers, and open controllers. No active exploitation confirmed (not in CISA KEV). EPSS score not provided in dataset. CVSS 4.0 score of 9.3 reflects high impact across confidentiality, integrity, and availability in both vulnerable and subsequent systems.
Stored cross-site scripting in Siemens SIMATIC S7-1500 controller family web interface allows authenticated high-privilege attackers to inject malicious code via crafted PLC/station names in TIA project files. When users with appropriate rights later access the communication parameters page, injected scripts execute in their session context with high impact to confidentiality, integrity, and availability across system boundaries (CVSS 9.3, CVSS:4.0 S:H). No public exploit identified at time of analysis, but CVSS vector indicates low attack complexity (AC:L) once attacker gains privileged project upload access.
Stored cross-site scripting (CWE-79) in the integrated web server Trace page of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPUs allows attacker-supplied JavaScript embedded in a crafted calculated-signal file to execute in the browser session of a user who holds the 'Read diagnostics' function right, after that user is socially engineered into importing the file. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1 medium), the attacker is unauthenticated at the network layer but must rely on the victim performing a manual import, and the resulting script can drive PLC operations through the web server only within that user's existing authorization scope. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so exploitation is not confirmed as active; the practical risk is concentrated in environments where the PLC web server is exposed and diagnostic staff routinely import calculated-signal files.
Reflected cross-site scripting in the integrated web server of a broad range of Siemens SIMATIC S7-1500, ET 200SP, and Drive Controller CPU families allows attacker-controlled JavaScript to execute in the browser of an authenticated user who imports a crafted CSV trace file on the Trace page. The signal names inside the imported file are not sanitized before being echoed back into an error message, so the script runs in the context of that user's session, with the assessed impact limited to low confidentiality and low integrity (CVSS 3.1 base 6.1, CWE-79). Exploitation is not self-propagating and requires social engineering: the victim must hold the 'Read diagnostics' function right and must be persuaded to import the malicious trace file, since the CVSS vector specifies PR:N but UI:R, meaning no attacker credentials are needed while user interaction is mandatory; no public exploit code has been identified and the issue is not listed as actively exploited at time of analysis.
Stored/DOM cross-site scripting (CWE-79, CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) in the web-based Trace page of Siemens SIMATIC S7-1500, ET 200SP and Drive Controller CPUs allows attacker-controlled JavaScript to run in an authenticated user's browser session when signal names taken from an imported CSV trace file are rendered unsanitized in Trace page selection menus. The attack is not self-triggering: an attacker must first socially engineer a user who holds the 'Read diagnostics' function right into importing a crafted trace file through the built-in CSV import feature, and execution occurs only when that victim subsequently interacts with an affected selection menu, so impact is confined to the victim's authenticated session with low confidentiality and integrity effects and no availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and there is no path for an unauthenticated remote attacker to trigger the flaw without victim interaction.
Cross-site scripting (CWE-79) in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPUs allows attacker-controlled JavaScript to run in an operator's browser when a crafted CSV trace file is imported and its calculated signal data is rendered on the Trace page. Exploitation is not automatic: an attacker must socially engineer a user who already holds the 'Read diagnostics' function right into importing the malicious file, and the injected script then executes within that user's session and can drive PLC operations through the web server, limited to that user's authorization scope. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1) reflects that access is remote over the network but requires victim interaction; there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP and SIMATIC Drive Controller CPUs allows an attacker to bury JavaScript inside the visual properties of calculated signals in a crafted CSV trace file, which then executes in the browser session of anyone who imports that file and opens the Trace page. Exploitation is neither remote nor automatic: the CPU web server must be enabled and reachable, and a social-engineered operator holding the 'Read diagnostics' function right must import the file (CVSS 6.1, UI:R, PR:N), after which any resulting PLC operations are confined to that operator's own authorization scope. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Denial of service in Siemens SIMATIC S7-PLCSIM Advanced (all versions) allows an unauthenticated attacker on the same local network segment to exhaust the application's memory by flooding it with high-volume multicast traffic, rendering the PLC simulation instance inaccessible until manually restarted. Exploitation is limited to instances running a specific active project configuration, and no project data is lost. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
The login endpoint /FormLogin in affected web services does not apply proper origin checking. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
A vulnerability has been identified in SIMATIC Drive Controller family (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been identified in SIMATIC CP 1626 (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The webserver of the affected devices contains a vulnerability that may lead to a denial of service condition. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPU families allows an attacker to have malicious JavaScript run in the browser session of a plant engineer who imports a booby-trapped CSV trace file. The flaw is CWE-79: visual-marker data inside imported CSV trace files is not validated or sanitized before it is rendered on the controller's Trace page, so script embedded in that field executes in the web-server origin once the file is opened. Exploitation is not autonomous - per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) it is unauthenticated at the network layer but requires user interaction (UI:R) and a victim holding the 'Read diagnostics' function right, and the resulting script can perform PLC operations through the web server limited to that user's authorization; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). The severity is high (CVSS 4.0 base 9.4; assessed 3.1 10.0 with scope change) because a successful script can reach high-integrity PLC operations from the controller's own trusted web session.
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, Drive Controller and S7-1500 Software Controller CPUs lets attacker-controlled JavaScript execute in a privileged operator's browser session after that user is social-engineered into importing a crafted trace file and its unsanitized comment fields are rendered on the Trace page (reported CVSS 4.0 base 9.4; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Because the script runs inside the victim's authenticated session, it can perform PLC operations through the same web server within the scope of that user's authorization, so impact is bounded by the victim's privileges rather than by the attacker's. Exploitation is gated by user interaction and by a reachable/enabled CPU web server, and the victim must already hold the 'Read diagnostics' function right; no public exploit code or CISA KEV entry is associated with this CVE in the available data (no public exploit identified at time of analysis).
Importing a maliciously crafted trace file into the integrated web server of a Siemens SIMATIC S7-1500 (and closely related ET 200SP, Drive Controller, Open Controller and S7-1500 Software Controller) CPU causes attacker-supplied JavaScript to execute inside the victim engineer's authenticated browser session and can issue PLC operations within that user's own authorization scope. Exploitation is not automated and not a mass-exploitation threat: it requires the CPU web server to be enabled, a victim who holds the 'Read diagnostics' function right, and successful social engineering into a manual file import (UI:A per the CVSS vector, which also carries PR:N, meaning the attacker needs no credentials of their own). The severity is high (CVSS 9.4 in the vendor's CVSS 4.0 assessment; our independent 3.1 assessment scores it AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), but this is a genuine high-severity issue rather than an imminent mass-exploitation threat - no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was provided in the source data.
Cross-site scripting (XSS) in Siemens SIMATIC S7-1500 PLC family firmware upload interface allows authenticated attackers to execute malicious JavaScript in administrator sessions via crafted filenames. This stored XSS requires social engineering to trick authenticated users into selecting the attacker-supplied firmware file on the web-based management interface. Successful exploitation enables session hijacking and credential theft without requiring the malicious file to be uploaded. EPSS data not provided, no CISA KEV status confirmed, affecting industrial automation controllers widely deployed in critical infrastructure environments.
Stored cross-site scripting (XSS) in Siemens SIMATIC S7-1500 and ET 200SP controller families allows authenticated attackers with high privileges to inject malicious scripts via Technology Object (TO) names when downloading TIA Portal projects. The scripts execute when authorized users access the Motion Control Diagnostics web interface page, enabling session hijacking, credential theft, or privileged actions performed under the victim's context. This affects over 100 product variants across industrial automation controllers, software controllers, and open controllers. No active exploitation confirmed (not in CISA KEV). EPSS score not provided in dataset. CVSS 4.0 score of 9.3 reflects high impact across confidentiality, integrity, and availability in both vulnerable and subsequent systems.
Stored cross-site scripting in Siemens SIMATIC S7-1500 controller family web interface allows authenticated high-privilege attackers to inject malicious code via crafted PLC/station names in TIA project files. When users with appropriate rights later access the communication parameters page, injected scripts execute in their session context with high impact to confidentiality, integrity, and availability across system boundaries (CVSS 9.3, CVSS:4.0 S:H). No public exploit identified at time of analysis, but CVSS vector indicates low attack complexity (AC:L) once attacker gains privileged project upload access.
Stored cross-site scripting (CWE-79) in the integrated web server Trace page of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPUs allows attacker-supplied JavaScript embedded in a crafted calculated-signal file to execute in the browser session of a user who holds the 'Read diagnostics' function right, after that user is socially engineered into importing the file. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1 medium), the attacker is unauthenticated at the network layer but must rely on the victim performing a manual import, and the resulting script can drive PLC operations through the web server only within that user's existing authorization scope. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so exploitation is not confirmed as active; the practical risk is concentrated in environments where the PLC web server is exposed and diagnostic staff routinely import calculated-signal files.
Reflected cross-site scripting in the integrated web server of a broad range of Siemens SIMATIC S7-1500, ET 200SP, and Drive Controller CPU families allows attacker-controlled JavaScript to execute in the browser of an authenticated user who imports a crafted CSV trace file on the Trace page. The signal names inside the imported file are not sanitized before being echoed back into an error message, so the script runs in the context of that user's session, with the assessed impact limited to low confidentiality and low integrity (CVSS 3.1 base 6.1, CWE-79). Exploitation is not self-propagating and requires social engineering: the victim must hold the 'Read diagnostics' function right and must be persuaded to import the malicious trace file, since the CVSS vector specifies PR:N but UI:R, meaning no attacker credentials are needed while user interaction is mandatory; no public exploit code has been identified and the issue is not listed as actively exploited at time of analysis.
Stored/DOM cross-site scripting (CWE-79, CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) in the web-based Trace page of Siemens SIMATIC S7-1500, ET 200SP and Drive Controller CPUs allows attacker-controlled JavaScript to run in an authenticated user's browser session when signal names taken from an imported CSV trace file are rendered unsanitized in Trace page selection menus. The attack is not self-triggering: an attacker must first socially engineer a user who holds the 'Read diagnostics' function right into importing a crafted trace file through the built-in CSV import feature, and execution occurs only when that victim subsequently interacts with an affected selection menu, so impact is confined to the victim's authenticated session with low confidentiality and integrity effects and no availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and there is no path for an unauthenticated remote attacker to trigger the flaw without victim interaction.
Cross-site scripting (CWE-79) in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPUs allows attacker-controlled JavaScript to run in an operator's browser when a crafted CSV trace file is imported and its calculated signal data is rendered on the Trace page. Exploitation is not automatic: an attacker must socially engineer a user who already holds the 'Read diagnostics' function right into importing the malicious file, and the injected script then executes within that user's session and can drive PLC operations through the web server, limited to that user's authorization scope. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1) reflects that access is remote over the network but requires victim interaction; there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP and SIMATIC Drive Controller CPUs allows an attacker to bury JavaScript inside the visual properties of calculated signals in a crafted CSV trace file, which then executes in the browser session of anyone who imports that file and opens the Trace page. Exploitation is neither remote nor automatic: the CPU web server must be enabled and reachable, and a social-engineered operator holding the 'Read diagnostics' function right must import the file (CVSS 6.1, UI:R, PR:N), after which any resulting PLC operations are confined to that operator's own authorization scope. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Denial of service in Siemens SIMATIC S7-PLCSIM Advanced (all versions) allows an unauthenticated attacker on the same local network segment to exhaust the application's memory by flooding it with high-volume multicast traffic, rendering the PLC simulation instance inaccessible until manually restarted. Exploitation is limited to instances running a specific active project configuration, and no project data is lost. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
The login endpoint /FormLogin in affected web services does not apply proper origin checking. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
A vulnerability has been identified in SIMATIC Drive Controller family (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been identified in SIMATIC CP 1626 (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The webserver of the affected devices contains a vulnerability that may lead to a denial of service condition. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.