Introduction
A stored cross-site scripting vulnerability in the embedded web server of Siemens SIMATIC S7 PLCs lets an attacker with engineering access plant malicious JavaScript that fires in the browser of any operator who views a specific configuration page. CVE-2026-25786 has a CVSS v3.1 score of 9.1 and a scope change that extends impact beyond the PLC itself. That makes it a meaningful risk to industrial environments that use web-based PLC management, particularly because several affected product variants will never receive a fix.
Technical Information
The root cause of CVE-2026-25786 is classified under CWE 79: Improper Neutralization of Input During Web Page Generation. Affected SIMATIC S7 devices fail to properly validate and sanitize the PLC or station name when they render it on the "communication parameters" page of the embedded web interface. User-controlled input, specifically the project name configured in TIA Portal, goes into the HTML of the page without adequate encoding or escaping.
The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, and the CVSS v4.0 vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. The scope change (S:C in v3.1) exists because the vulnerable component is the PLC web server, while the impacted component is the victim's browser session, which operates in a different trust boundary.
Attack Flow
Exploitation proceeds in these steps:
-
The attacker must hold valid credentials and authorization to download a TIA project into the target PLC. This is a privileged operation, but in many industrial environments, engineering workstation access is shared or insufficiently segmented.
-
The attacker creates a TIA project whose PLC or station name contains JavaScript or other script content. The payload sits in the project metadata instead of being injected through the web interface directly.
-
The attacker downloads (deploys) the crafted TIA project to the target SIMATIC S7 device using TIA Portal. The PLC now stores the malicious station name persistently.
-
When any user with appropriate rights opens the communication parameters page of the PLC web interface, the web server renders the station name without proper sanitization. The injected script executes within the victim's authenticated web session.
-
Because the script runs in the victim's session context, the attacker can act on the victim's behalf. Per the published CVSS vectors, this can have a high impact on confidentiality, integrity, and availability. Potential actions include reading sensitive configuration data, modifying PLC parameters, or disrupting operations.
The pattern is classic stored (persistent) XSS, but the injection vector is unusual. The payload enters through the engineering tool (TIA Portal) rather than through the web interface itself, so traditional web application firewalls or input validation at the HTTP layer are not enough as the only defense.
Sibling Vulnerabilities
Siemens advisory SSA 688146 also documents related vulnerabilities with similar mechanics. CVE-2026-25787 targets the Technology Object name rendered on the Motion Control Diagnostics page, and CVE-2026-25789 targets filenames on the Firmware Update page. All three trust project or file metadata to be safe to render in HTML without sanitization.
Affected Systems and Versions
The advisory covers a broad set of SIMATIC S7 1500 and ET 200SP variants, and remediation is uneven across product families:
| Product Family | Affected Versions | Remediation Status | Target Version |
|---|---|---|---|
| SIMATIC Drive Controller CPU 1504D TF | All versions prior to V3.1.6 | Update available | V3.1.6 or later |
| SIMATIC ET 200SP CPU 1510SP F 1 PN | All versions prior to V2.9.9 | Update available | V2.9.9 or later |
| SIMATIC S7 1500 CPU 1513 1 PN | All versions | Currently no fix is planned | None |
| SIMATIC S7 PLCSIM Advanced | All versions | Currently no fix is available | None |
The table lists a subset of the affected products in the full advisory. Organizations should consult SSA 688146 directly for the complete product list and the remediation status of each product.
Where updates are available, Siemens recommends updating to V2.9.9 or V3.1.6, depending on the product family. Where no fix is planned, compensating controls are mandatory. For CVE-2026-25786 and CVE-2026-25787, the primary mitigation Siemens recommends is restricting TIA project download to trusted personnel only. For CVE-2026-25789, organizations must restrict access to the firmware update function right to instructed personnel.
As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms and configuring the environment according to Siemens' operational guidelines for Industrial Security.
