CVE-2026-25789: Siemens SIMATIC S7 PLCs XSS in Firmware Update page

CVE-2026-25789 · Severity: high · CVSS 7.1 · Published 2026-05-12

Siemens SIMATIC S7 PLCs, which are industrial controllers used to automate factory processes and infrastructure, are affected by a security flaw in their built-in web management interface. An attacker could trick an authorized user into selecting a specially crafted file on the firmware update page, causing malicious code to run in the user's browser. This could allow the attacker to steal login credentials or take over the user's active session, potentially gaining unauthorized access to the industrial control system.

Technologies: Siemens SIMATIC Drive Controller CPU 1504D TF, Siemens SIMATIC Drive Controller CPU 1507D TF, Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2, Siemens SIMATIC S7-1500 CPU family. Vendors: Siemens.

Quick answers

Is CVE-2026-25789 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-25789 being exploited in the wild.
How severe is CVE-2026-25789?
High severity, with a CVSS score of 7.1, published 12 May 2026.
Which products and versions are affected?
Siemens SIMATIC Drive Controller CPU 1504D TF < V3.1.6; Siemens SIMATIC Drive Controller CPU 1507D TF < V3.1.6; Siemens SIMATIC Drive Controller family All versions < V3.1.6; Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0) < V2.9.9; and 5 more.
Is there a fix for CVE-2026-25789?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-25789 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-25789?
Check whether you run Siemens SIMATIC Drive Controller CPU 1504D TF, Siemens SIMATIC Drive Controller CPU 1507D TF, Siemens SIMATIC Drive Controller family or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Scripting (XSS) vulnerability (CWE-79) exists in the web server component of multiple Siemens SIMATIC S7 PLC families. The vulnerability is located in the Firmware Update page, which fails to properly validate and sanitize filenames before they are processed by the browser. An attacker with low privileges could use social engineering to trick an authenticated administrator into selecting a maliciously named file. The exploit triggers JavaScript execution in the context of the user's session even without the file being fully uploaded. Siemens has released firmware updates for several product lines (e.g., V3.1.6, V2.9.9, V4.1.6) to address this issue, though some legacy models currently have no planned fix.

Affected products

  • Siemens SIMATIC Drive Controller CPU 1504D TF < V3.1.6
  • Siemens SIMATIC Drive Controller CPU 1507D TF < V3.1.6
  • Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0) < V2.9.9
  • Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SK03-0AB0) < V4.1.6
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 All versions
  • Siemens SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK01-0AB0) < V2.9.9

Timeline

  • 2026-05-12: advisory: Initial publication by Siemens and NVD
  • 2026-07-14: other: Advisory updated to version V1.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.