IT SBIT Services
Schneeberger
DEEN
CVE tracker

Siemens SIMATIC S7-1500: Cross-site scripting in web server trace import

CVE-2026-63353Critical 9.4

← All vulnerabilities

Summary

Several Siemens SIMATIC S7-1500, ET 200SP and Drive Controller CPUs contain a flaw in the web server, where comment fields in imported trace files are not properly sanitized before they are shown on the Trace page. An attacker who convinces an authorized user with the "Read diagnostics" right to import a crafted trace file can run JavaScript in that user's browser session and perform PLC operations within that user's authorization. The attack requires user interaction but no prior account.

Affected

  • SIMATIC Drive Controller CPU 1504D TF and 1507D TF
  • SIMATIC ET 200SP CPUs 1510SP, 1512SP, 1514SP and 1514SPT (F and non-F variants)
  • SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)
  • Siemens lists all versions as affected; CISA lists the wider S7-1500 CPU family
  • CVSS 4.0 base score: 9.4 (critical)

Fixed in

Unknown. Siemens is preparing fixes; no fixed versions were available at the time of the latest information.

Workaround

  • Disable the web server on CPUs where it is not required.
  • Restrict network access to the devices with suitable mechanisms and keep them off the internet.
  • Limit access to ports 80 and 443 to engineering workstations where the web server is needed.
  • Do not import trace files from untrusted sources.
  • Check whether the web server was enabled in your projects; it is deactivated in the delivery state.

Exploitation

  • No evidence of exploitation in the wild has been reported.
  • No public proof-of-concept exploit was found.
  • CISA SSVC: exploitation none, automatable no, technical impact total.
  • EPSS was low (0.00413) in the latest snapshot seen.

Our recommendation

  • Identify all S7-1500, ET 200SP and Drive Controller CPUs and check whether their web server is enabled.
  • Disable the web server where it is not needed and isolate the remaining devices from the internet and untrusted networks.
  • Restrict who may import trace files and train users to reject unexpected files.
  • Apply Siemens fixes as soon as they are released and check the advisory SSA-591731 for updates.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:05.

Original description (NVD)

Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed