Siemens SIMATIC S7-1500: Code injection via crafted trace file in web server
Summary
Affected SIMATIC S7-1500 and ET 200SP CPUs do not properly restrict executable content in imported trace files. An attacker who tricks an authorized user holding the "Read diagnostics" right into importing a crafted trace file can execute JavaScript in that user's browser session. The script can then perform PLC operations within the scope of that user's authorization.
Affected
- SIMATIC Drive Controller CPU 1504D TF and 1507D TF
- SIMATIC ET 200SP CPUs 1510SP, 1512SP, 1514SP and 1514SPT (F and non-F variants)
- SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)
- All versions are affected according to Siemens. Exact product list: see Siemens advisory SSA-591731.
Fixed in
Unknown. Siemens is preparing fixes; currently no fix is available.
Workaround
- Disable the web server on devices where it is not required.
- Upload only trusted trace files.
- Restrict web server access to qualified personnel.
- Keep PLCs isolated from the internet and reachable only from trusted networks.
Exploitation
- Known exploited: no (per CISA SSVC: exploitation none, automatable no).
- No public proof-of-concept found for this CVE; a sibling CVE in the same advisory has no public exploit.
- EPSS: 0.00335.
Our recommendation
- Check whether the web server of your S7-1500 or ET 200SP CPUs is enabled and reachable from office or internet networks, and disable it where not needed.
- Limit the "Read diagnostics" right to trusted staff and train users not to import trace files from unknown sources.
- Keep PLCs out of internet access and segment them from office networks.
- Monitor SSA-591731 and apply Siemens fixes as soon as they are released.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Siemens SSA-591731 cert-portal.siemens.com
- CISA ICSA-26-295-14 www.cisa.gov
- CISA SSVC / Vulnrichment (HOL) hol.org
- Vulners CVE record vulners.com
- Beyond Machines advisory summary beyondmachines.net
- SecurityOnline S7-1500 vulnerabilities securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:06.
Original description (NVD)
Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.