目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CVE-2026-63351— S7-1500S7-1200CSV导入JavaScript执行漏洞

一分钟漏洞结论

影响对象
Siemens SIMATIC Drive Controller CPU 1504D TF
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

受影响的设备在未将 CSV 跟踪文件导入并呈现到跟踪页面前，未能正确验证和清理其中包含的计算信号的视觉属性。 这可能导致攻击者通过社会工程学手段，诱使拥有“读取诊断”权限的授权用户导入一个特制的跟踪文件。一旦成功利用，攻击者可以在用户的浏览器会话中执行其控制的 JavaScript 代码，并在该用户授权范围内，通过 Web 服务器对 PLC（可编程逻辑控制器）执行操作。

CVSS 6.1 · Medium

影响版本矩阵 157

厂商产品 版本范围状态
Siemens SIMATIC Drive Controller CPU 1504D TF < * affected
Siemens SIMATIC Drive Controller CPU 1507D TF < * affected
Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN < * affected
< * affected
Siemens SIMATIC ET 200SP CPU 1510SP-1 PN < * affected
< * affected
Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN < * affected
< * affected
Siemens SIMATIC ET 200SP CPU 1512SP-1 PN < * affected
< * affected
Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN < * affected
Siemens SIMATIC ET 200SP CPU 1514SP-2 PN < * affected
Siemens SIMATIC ET 200SP CPU 1514SPT F-2 PN < * affected
Siemens SIMATIC ET 200SP CPU 1514SPT-2 PN < * affected
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) < * affected
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V2 CPUs - Windows OS < * affected
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Industrial OS < * affected
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Windows OS < * affected
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 CPUs < * affected
Siemens SIMATIC S7-1500 CPU 1511-1 PN < * affected
< * affected
< * affected
< * affected
Siemens SIMATIC S7-1500 CPU 1511C-1 PN < * affected
< * affected
< * affected
Siemens SIMATIC S7-1500 CPU 1511F-1 PN < * affected
< * affected
< * affected
Siemens SIMATIC S7-1500 CPU 1511T-1 PN < * affected
< * affected
Siemens SIMATIC S7-1500 CPU 1511TF-1 PN < * affected
< * affected
Siemens SIMATIC S7-1500 CPU 1512C-1 PN < * affected
< * affected
< * affected
Siemens SIMATIC S7-1500 CPU 1513-1 PN < * affected
< * affected
< * affected
Siemens SIMATIC S7-1500 CPU 1513F-1 PN < * affected
< * affected
< * affected
Siemens SIMATIC S7-1500 CPU 1513pro F-2 PN < * affected
Siemens SIMATIC S7-1500 CPU 1513pro-2 PN < * affected
Siemens SIMATIC S7-1500 CPU 1515-2 PN < * affected
< * affected
< * affected
Siemens SIMATIC S7-1500 CPU 1515F-2 PN < * affected
< * affected
< * affected
Siemens SIMATIC S7-1500 CPU 1515T-2 PN < * affected
< * affected
Siemens SIMATIC S7-1500 CPU 1515TF-2 PN < * affected
< * affected
Siemens SIMATIC S7-1500 CPU 1516-3 PN/DP < * affected
< * affected
< * affected
Siemens SIMATIC S7-1500 CPU 1516F-3 PN/DP < * affected
< * affected
< * affected
Siemens SIMATIC S7-1500 CPU 1516pro F-2 PN < * affected
Siemens SIMATIC S7-1500 CPU 1516pro-2 PN < * affected
Siemens SIMATIC S7-1500 CPU 1516T-3 PN < * affected
Siemens SIMATIC S7-1500 CPU 1516T-3 PN/DP < * affected
Siemens SIMATIC S7-1500 CPU 1516TF-3 PN < * affected
Siemens SIMATIC S7-1500 CPU 1516TF-3 PN/DP < * affected
Siemens SIMATIC S7-1500 CPU 1517-3 PN < * affected
Siemens SIMATIC S7-1500 CPU 1517-3 PN/DP < * affected
Siemens SIMATIC S7-1500 CPU 1517F-3 PN < * affected
Siemens SIMATIC S7-1500 CPU 1517F-3 PN/DP < * affected
< * affected
Siemens SIMATIC S7-1500 CPU 1517T-3 PN < * affected
Siemens SIMATIC S7-1500 CPU 1517T-3 PN/DP < * affected
Siemens SIMATIC S7-1500 CPU 1517TF-3 PN < * affected
Siemens SIMATIC S7-1500 CPU 1517TF-3 PN/DP < * affected
Siemens SIMATIC S7-1500 CPU 1518-3 PN < * affected
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP < * affected
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP < * affected
< * affected
Siemens SIMATIC S7-1500 CPU 1518F-3 PN < * affected
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP < * affected
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP < * affected
< * affected
Siemens SIMATIC S7-1500 CPU 1518T-3 PN < * affected
Siemens SIMATIC S7-1500 CPU 1518T-4 PN/DP < * affected
Siemens SIMATIC S7-1500 CPU 1518TF-3 PN < * affected
Siemens SIMATIC S7-1500 CPU 1518TF-4 PN/DP < * affected
Siemens SIMATIC S7-1500 CPU S7-1518-4 PN/DP ODK < * affected
Siemens SIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODK < * affected
Siemens SIMATIC S7-1500 ET 200pro: CPU 1513PRO F-2 PN < * affected
Siemens SIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PN < * affected
Siemens SIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PN < * affected
Siemens SIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PN < * affected
Siemens SIMATIC S7-1500 Software Controller CPU 1507S F V2 < * affected
Siemens SIMATIC S7-1500 Software Controller CPU 1507S F V3 < * affected
Siemens SIMATIC S7-1500 Software Controller CPU 1507S F V4 < * affected
Siemens SIMATIC S7-1500 Software Controller CPU 1507S V2 < * affected
Siemens SIMATIC S7-1500 Software Controller CPU 1507S V3 < * affected
Siemens SIMATIC S7-1500 Software Controller CPU 1507S V4 < * affected
Siemens SIMATIC S7-1500 Software Controller CPU 1508S F V2 < * affected
Siemens SIMATIC S7-1500 Software Controller CPU 1508S F V3 < * affected
Siemens SIMATIC S7-1500 Software Controller CPU 1508S F V4 < * affected
Siemens SIMATIC S7-1500 Software Controller CPU 1508S T V3 < * affected
Siemens SIMATIC S7-1500 Software Controller CPU 1508S TF V3 < * affected
Siemens SIMATIC S7-1500 Software Controller CPU 1508S V2 < * affected
Siemens SIMATIC S7-1500 Software Controller CPU 1508S V3 < * affected
Siemens SIMATIC S7-1500 Software Controller CPU 1508S V4 < * affected
Siemens SIMATIC S7-1500 Software Controller Linux V2 < * affected
Siemens SIMATIC S7-1500 Software Controller Linux V3 < * affected
Siemens SIMATIC S7-PLCSIM Advanced < * affected
Siemens SIPLUS ET 200SP CPU 1510SP F-1 PN < * affected
Siemens SIPLUS ET 200SP CPU 1510SP F-1 PN RAIL < * affected
Siemens SIPLUS ET 200SP CPU 1510SP-1 PN < * affected
< * affected
Siemens SIPLUS ET 200SP CPU 1510SP-1 PN RAIL < * affected
< * affected
Siemens SIPLUS ET 200SP CPU 1512SP F-1 PN < * affected
< * affected
Siemens SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL < * affected
< * affected
Siemens SIPLUS ET 200SP CPU 1512SP-1 PN < * affected
< * affected
Siemens SIPLUS ET 200SP CPU 1512SP-1 PN RAIL < * affected
< * affected
Siemens SIPLUS S7-1500 CPU 1511-1 PN < * affected
< * affected
< * affected
< * affected
Siemens SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL < * affected
< * affected
Siemens SIPLUS S7-1500 CPU 1511-1 PN TX RAIL < * affected
< * affected
Siemens SIPLUS S7-1500 CPU 1511F-1 PN < * affected
< * affected
Siemens SIPLUS S7-1500 CPU 1513-1 PN < * affected
< * affected
< * affected
< * affected
Siemens SIPLUS S7-1500 CPU 1513F-1 PN < * affected
< * affected
Siemens SIPLUS S7-1500 CPU 1515F-2 PN < * affected
< * affected
Siemens SIPLUS S7-1500 CPU 1515F-2 PN RAIL < * affected
Siemens SIPLUS S7-1500 CPU 1515F-2 PN T2 RAIL < * affected
Siemens SIPLUS S7-1500 CPU 1516-3 PN/DP < * affected
< * affected
< * affected
< * affected
Siemens SIPLUS S7-1500 CPU 1516-3 PN/DP RAIL < * affected
Siemens SIPLUS S7-1500 CPU 1516-3 PN/DP TX RAIL < * affected
Siemens SIPLUS S7-1500 CPU 1516F-3 PN/DP < * affected
< * affected
Siemens SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL < * affected
< * affected
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP < * affected
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP < * affected
Siemens SIPLUS S7-1500 CPU 1518F-4 PN/DP < * affected
获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2026-63351 基础信息

漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
N/A
来源: CVE Program / CVE List V5
Vulnerability Description
Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
来源: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
来源: CVE Program / CVE List V5

受影响产品

厂商 产品 影响版本 CPE 订阅
Siemens SIMATIC Drive Controller CPU 1504D TF 0 ~ * -
Siemens SIMATIC Drive Controller CPU 1507D TF 0 ~ * -
Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN 0 ~ * -
Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN 0 ~ * -
Siemens SIMATIC ET 200SP CPU 1510SP-1 PN 0 ~ * -
Siemens SIMATIC ET 200SP CPU 1510SP-1 PN 0 ~ * -
Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN 0 ~ * -
Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN 0 ~ * -
Siemens SIMATIC ET 200SP CPU 1512SP-1 PN 0 ~ * -
Siemens SIMATIC ET 200SP CPU 1512SP-1 PN 0 ~ * -
Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN 0 ~ * -
Siemens SIMATIC ET 200SP CPU 1514SP-2 PN 0 ~ * -
Siemens SIMATIC ET 200SP CPU 1514SPT F-2 PN 0 ~ * -
Siemens SIMATIC ET 200SP CPU 1514SPT-2 PN 0 ~ * -
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) 0 ~ * -
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V2 CPUs - Windows OS 0 ~ * -
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Industrial OS 0 ~ * -
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Windows OS 0 ~ * -
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 CPUs 0 ~ * -
Siemens SIMATIC S7-1500 CPU 1511-1 PN 0 ~ * -
Siemens SIMATIC S7-1500 CPU 1511-1 PN 0 ~ * -
Siemens SIMATIC S7-1500 CPU 1511-1 PN 0 ~ * -
Siemens SIMATIC S7-1500 CPU 1511-1 PN 0 ~ * -
Siemens SIMATIC S7-1500 CPU 1511C-1 PN 0 ~ * -
Siemens SIMATIC S7-1500 CPU 1511C-1 PN 0 ~ * -
Siemens SIMATIC S7-1500 CPU 1511C-1 PN 0 ~ * -
Siemens SIMATIC S7-1500 CPU 1511F-1 PN 0 ~ * -
Siemens SIMATIC S7-1500 CPU 1511F-1 PN 0 ~ * -
Siemens SIMATIC S7-1500 CPU 1511F-1 PN 0 ~ * -
Siemens SIMATIC S7-1500 CPU 1511T-1 PN 0 ~ * -

二、漏洞 CVE-2026-63351 的公开POC

# POC 描述 源链接 神龙链接
AI 生成 POC 高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2026-63351 的情报信息

请登录查看更多情报信息。

CVE-2026-63351 厂商安全公告 (1)

同批安全公告 · Siemens · 2026-10-13 · 共 32 条

CVE-2026-63350 9.6 CRITICAL Siemens Trace文件解析漏洞，导致浏览器端JS执行
CVE-2026-63353 9.6 CRITICAL Siemens Trace文件XSS漏洞：恶意JS执行并越权操控PLC
CVE-2026-63354 9.6 CRITICAL Siemens PLCs XSS漏洞（读取诊断权限）
CVE-2026-44415 9.1 CRITICAL GitLab越权访问漏洞
CVE-2026-89197 8.8 HIGH RUGGEDCOM CROSSBOW V6.0以下版本SQL注入漏洞
CVE-2026-89198 8.8 HIGH RUGGEDCOM CROSSBOW<6.0任意SQL注入漏洞
CVE-2026-89199 8.8 HIGH RUGGEDCOM CROSSBOW < V6.0信息泄露漏洞
CVE-2026-89196 8.8 HIGH RUGGEDCOM CROSSBOW V6.0以下版本存在SQL注入漏洞
CVE-2026-59241 8.8 HIGH SIMATIC WinCC越权漏洞（CVE-2024-12345）
CVE-2026-78557 8.3 HIGH Industrial Edge App Publisher V1.27.9以下版本RCE漏洞
CVE-2026-102073 8.2 HIGH 艾礼富MBC/MEC/PXC/TALON远程内存读取及DoS
CVE-2026-72895 7.7 HIGH SIMATIC IPC系列安全启动绕过漏洞
CVE-2026-102076 7.5 HIGH Apogee系列软件Web服务拒绝服务漏洞
CVE-2026-85114 7.5 HIGH .NET Client Library <V3.3.61 路径遍历漏洞
CVE-2026-102075 7.5 HIGH Apogee/Talon设备Web服务DoS漏洞
CVE-2026-102074 7.5 HIGH Apogee系列软件FTP服务拒绝服务漏洞
CVE-2026-89201 7.5 HIGH RUGGEDCOM CROSSBOW <V6.0 SQL注入漏洞
CVE-2026-78556 7.4 HIGH Industrial Edge App Publisher TLS证书验证绕过漏洞
CVE-2026-44414 6.8 MEDIUM CVE-2026-44414
CVE-2026-89200 6.7 MEDIUM RUGGEDCOM CROSSBOW SQL注入漏洞

显示前 20 条，共 32 条。 查看全部 &rarr; →

IV. Related Vulnerabilities

Same product: SIMATIC Drive Controller CPU 1504D TF
Same vendor: Siemens
Same weakness: CWE-79

V. Comments for CVE-2026-63351

暂无评论

发表评论