Siemens SIMATIC S7 PLCs Web Server XSS Vulnerabilities Advisory

Siemens Security Advisory SSA-688146 Vulnerability Summary Vulnerability Overview The Web server of Siemens SIMATIC S7 PLCs contains multiple cross-site scripting (XSS) vulnerabilities. Attackers could exploit these vulnerabilities to execute malicious scripts, potentially leading to session hijacking or credential theft. Affected Products The following products are affected: SIMATIC Drive Controller series SIMATIC ET 200SP Open Controller (including SIMPLUS variants) SIMATIC S7-1500 CPU series (including related ET 200 CPUs and SIMPLUS variants) SIMATIC S7-1500 Software Controller SIMATIC S7-PLCSIM Advanced all versions Remediation 1. Update Firmware: Siemens has released new versions. It is recommended to update to the latest version. 2. Restrict Access: - Restrict TIA project downloads to trusted personnel. - Restrict TIA project downloads to trusted personnel. - Restrict access to the "Firmware Update" function to authorized personnel. 3. Follow Security Recommendations: Configure the environment according to Siemens Industrial Security Guidelines and follow the relevant security recommendations. Vulnerability Details CVE-2026-25786 Description: The device does not properly validate and sanitize the PLCstation name on the "Communication" parameters page. CVSS v3.1 Base Score: 9.1 CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS v4.0 Base Score: 9.3 CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:R/VC:H/HA:H/SC:H/SI:H/SA:H CWE: CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) CVE-2026-25787 Description: The device does not properly validate and sanitize the Technology Object (TO) name on the "Motion Control Diagnostics" page. CVSS v3.1 Base Score: 9.1 CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS v4.0 Base Score: 9.3 CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:R/VC:H/HA:H/SC:H/SI:H/SA:H CWE: CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) CVE-2026-25789 Description: The device does not properly validate and sanitize the filename on the firmware update page. CVSS v3.1 Base Score: 7.1 CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS v4.0 Base Score: 7.2 CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:R/VC:H/HA:H/SC:L/SI:L/SA:H CWE: CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Additional Information Publication Date: 2026-05-12 Last Update: 2026-05-12 Current Version: V1.0 CVSS v3.1 Base Score: 9.1 CVSS v4.0 Base Score: 9.3 Acknowledgments Thanks to Lukas Sofmann for reporting these vulnerabilities. Further Information For more information on security vulnerabilities in Siemens products and security solutions, please contact the Siemens ProductCERT. Revision History V1.0 (2026-05-12): Publication date Terms of Use Use of this Siemens Security Advisory constitutes acceptance of its terms and conditions.

Goal Reached Thanks to every supporter — we hit 100%!

Siemens SIMATIC S7 PLCs Web Server XSS Vulnerabilities Advisory