Vulnerability details
CVE-2026-63354
Siemens SIMATIC Drive Controller CPU 1504D TFSiemens SIMATIC Drive Controller CPU 1507D TFSiemens SIMATIC ET 200SP CPU 1510SP F-1 PNSiemens SIMATIC ET 200SP CPU 1510SP-1 PNSiemens SIMATIC ET 200SP CPU 1512SP F-1 PNSiemens SIMATIC ET 200SP CPU 1512SP-1 PN
CVSS 4.0
9.4Critical
Official description
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.4Critical | 4.0 | CVEProject cvelistV5 (CNA) (siemens) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| 9.6Critical | 3.1 | CVEProject cvelistV5 (CNA) (siemens) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Siemens | SIMATIC Drive Controller CPU 1504D TF | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC Drive Controller CPU 1507D TF | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC ET 200SP CPU 1510SP F-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC ET 200SP CPU 1510SP F-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC ET 200SP CPU 1510SP-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC ET 200SP CPU 1510SP-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC ET 200SP CPU 1512SP F-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC ET 200SP CPU 1512SP F-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC ET 200SP CPU 1512SP-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC ET 200SP CPU 1512SP-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC ET 200SP CPU 1514SP F-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC ET 200SP CPU 1514SP-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC ET 200SP CPU 1514SPT F-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC ET 200SP CPU 1514SPT-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V2 CPUs - Windows OS | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Industrial OS | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Windows OS | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 CPUs | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1511-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1511-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1511-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1511-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1511C-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1511C-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1511C-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1511F-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1511F-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1511F-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1511T-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1511T-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1511TF-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1511TF-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1512C-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1512C-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1512C-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1513-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1513-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1513-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1513F-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1513F-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1513F-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1513pro F-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1513pro-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1515-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1515-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1515-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1515F-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1515F-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1515F-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1515T-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1515T-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1515TF-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1515TF-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1516-3 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1516-3 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1516-3 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1516F-3 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1516F-3 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1516F-3 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1516T-3 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1516T-3 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1516TF-3 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1516TF-3 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1516pro F-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1516pro-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1517-3 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1517-3 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1517F-3 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1517F-3 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1517F-3 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1517T-3 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1517T-3 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1517TF-3 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1517TF-3 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518-3 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518F-3 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518T-3 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518T-4 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518TF-3 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518TF-4 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU S7-1518-4 PN/DP ODK | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODK | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 ET 200pro: CPU 1513PRO F-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 Software Controller CPU 1507S F V2 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 Software Controller CPU 1507S F V3 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 Software Controller CPU 1507S F V4 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 Software Controller CPU 1507S V2 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 Software Controller CPU 1507S V3 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 Software Controller CPU 1507S V4 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 Software Controller CPU 1508S F V2 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 Software Controller CPU 1508S F V3 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 Software Controller CPU 1508S F V4 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 Software Controller CPU 1508S T V3 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 Software Controller CPU 1508S TF V3 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 Software Controller CPU 1508S V2 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 Software Controller CPU 1508S V3 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 Software Controller CPU 1508S V4 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 Software Controller Linux V2 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 Software Controller Linux V3 | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-PLCSIM Advanced | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS ET 200SP CPU 1510SP F-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS ET 200SP CPU 1510SP F-1 PN RAIL | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS ET 200SP CPU 1510SP-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS ET 200SP CPU 1510SP-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS ET 200SP CPU 1510SP-1 PN RAIL | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS ET 200SP CPU 1510SP-1 PN RAIL | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS ET 200SP CPU 1512SP F-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS ET 200SP CPU 1512SP F-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS ET 200SP CPU 1512SP-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS ET 200SP CPU 1512SP-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS ET 200SP CPU 1512SP-1 PN RAIL | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS ET 200SP CPU 1512SP-1 PN RAIL | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1511-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1511-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1511-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1511-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1511-1 PN TX RAIL | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1511-1 PN TX RAIL | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1511F-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1511F-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1513-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1513-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1513-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1513-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1513F-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1513F-1 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1515F-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1515F-2 PN | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1515F-2 PN RAIL | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1515F-2 PN T2 RAIL | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1516-3 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1516-3 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1516-3 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1516-3 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1516-3 PN/DP RAIL | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1516-3 PN/DP TX RAIL | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1516F-3 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1516F-3 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | All | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1518F-4 PN/DP | All | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-13
- Last updated
- 2026-10-16
- State
- Published
- Assigner (CNA)
- siemens
- Kolun priority
- 20 · Low
Exploit prediction (EPSS)
0.31%
Probability of exploitation in 30 days
24.4%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')