Siemens SIMATIC S7-1500 web server: Cross-site scripting via crafted CSV trace file
Summary
Siemens SIMATIC S7-1500 CPUs and related controllers have a cross-site scripting flaw in their web server. Imported CSV trace files are not properly sanitized before they are rendered on the Trace page. An attacker must socially engineer an authorized user with the "Read diagnostics" right into importing a crafted trace file. Successful exploitation can run attacker-controlled JavaScript in the user's browser session and perform PLC operations within that user's authorization.
Affected
- All versions of the products listed in Siemens advisory SSA-591731, including SIMATIC Drive Controller CPU 1504D TF and 1507D TF, ET 200SP CPUs (for example 1510SP, 1512SP, 1514SP) and ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants).
Fixed in
- Unknown. No fix is available yet; Siemens is preparing fixes.
Workaround
- Disable the web server if it is not needed.
- Restrict TCP ports 80 and 443 to trusted IP addresses.
- Permit web server access only to qualified personnel.
- Upload only trusted trace files.
- Keep the devices off the internet and office networks.
Exploitation
- No exploitation in the wild reported.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- Public proof-of-concept: unknown.
- EPSS 0.0045.
Our recommendation
- Inventory all S7-1500, ET 200SP and Drive Controller CPUs and identify those with the web server enabled.
- Disable the web server on devices where it is not required.
- Restrict access to ports 80 and 443 to trusted engineering networks.
- Limit the "Read diagnostics" right to necessary staff and brief them on social-engineering risks and trace file imports.
- Install Siemens fixes as soon as they are released and check the Siemens advisory for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Siemens ProductCERT SSA-591731 cert-portal.siemens.com
- CISA ICSA-26-295-14 www.cisa.gov
- NVD record via Vulners vulners.com
- Rapid7 record via Vulners (EPSS) vulners.com
- VulDB entry vuldb.com
- Security Boulevard daily OT security brief securityboulevard.com
- Red Tiger Security advisory summary www.redtigersecurity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:06.
Original description (NVD)
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.