SIMATIC S7-1500 web server flaws can hijack authorized browser sessions
Original title: Siemens SIMATIC S7 PLCs Web Server
All listed firmware versions are affected, Siemens is still preparing fixes, and eight CVEs are named.
Multiple vulnerabilities in the web server of SIMATIC S7-1500 devices could let an attacker run malicious code in an authorized user’s browser session and perform PLC operations within that user’s authorization. The advisory lists SIMATIC Drive Controller, ET 200SP, Open Controller, and S7-1500 CPU variants, all marked affected in every version. Siemens is preparing fixes and recommends mitigations where a fix is not yet available. Those mitigations are not described in the excerpt.
Unconfirmed: The excerpt does not state the specific mitigations Siemens recommends.
- The eight CVEs are CVE-2026-63350 through CVE-2026-63357.
- Every named CPU is listed as vers:all/*.
- Affected families include Drive Controller CPUs 1504D TF and 1507D TF.
- ET 200SP, Open Controller, and many S7-1500 order numbers are included.
- No fixed version is stated.
Impact: Code execution in an authorized browser session and PLC operations
| Product | Affected |
|---|---|
| Siemens SIMATIC Drive Controller CPU 1504D TF and 1507D TF | all versions |
| Siemens SIMATIC ET 200SP CPUs | all versions |
| Siemens SIMATIC ET 200SP Open Controller | all versions |
| Siemens SIMATIC S7-1500 CPUs | all versions |
- CVEs
- CVE-2026-63350CVE-2026-63351CVE-2026-63352CVE-2026-63353CVE-2026-63354CVE-2026-63355CVE-2026-63356CVE-2026-63357
- Vendors
- Siemens
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-63350 | JavaScript injection via imported trace files in Siemens devices | 9.4 | — | ||
| CVE-2026-63351 | Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on… | 5.3 | — | ||
| CVE-2026-63352 | Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page | 5.3 | — | ||
| CVE-2026-63353 | XSS in Siemens Trace import via unsanitized comments | 9.4 | — | ||
| CVE-2026-63354 | XSS via CSV trace import on Siemens PLC web UI | 9.4 | — | ||
| CVE-2026-63355 | Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page | 5.3 | — | ||
| CVE-2026-63356 | Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace… | 5.3 | — | ||
| CVE-2026-63357 | Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page | 5.3 | — |
From the original article
7 min read at cisa.govView CSAF Summary SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations within the scope of that user’s authorization. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.