SIMATIC S7-1500 web server flaws can hijack authorized browser sessions
All listed firmware versions are affected, Siemens is still preparing fixes, and eight CVEs are named.
64
CVE-2026-63354
XSS via CSV trace import on Siemens PLC web UI
- CVSS 4.0
- 9.4 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Siemens devices fail to validate and sanitize visual marker data in imported CSV trace files before rendering it on the Trace page, which is a cross-site scripting flaw (CWE-79). An attacker can social-engineer an authorized user who has the “Read diagnostics” right into importing a crafted trace file; no attacker privileges are required, but the victim must open the file. Attacker-controlled JavaScript then runs in that user’s browser session and can perform PLC operations through the web server within the user’s authorization, with high confidentiality, integrity, and availability impact on the device and subsequent systems (CVSS 4.0 9.4). The provided data does not name exact products or versions. It is not on the CISA KEV list, and no public proof-of-concept is known.
What to do: Do not import CSV trace files from untrusted sources, and limit the “Read diagnostics” right to users who need it. Apply the Siemens fix for CVE-2026-63354 when it is published for your device, and keep PLC web servers off untrusted networks. Treat unexpected Trace-page behavior after a CSV import as a possible compromise of that browser session.
| Product | Affected |
|---|---|
| Siemens Devices with a web-server Trace page that import CSV trace files and can issue PLC operations (product names and version | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
- Weakness
- CWE-79
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X