# CVE-2026-63351: Siemens SIMATIC S7 PLC web server CSV import code injection Source: https://junglewise.ai/threats/cve-2026-63351-affected-devices-do-not-properly-validate-and-sanitize-visual Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-10-13. Updated: 2026-10-16 License: CC BY 4.0 with a link back CVE-2026-63351 · Severity: medium · CVSS 6.1 · Published 2026-10-13 Siemens programmable logic controllers (PLCs) that manage industrial processes contain a vulnerability in their web-based diagnostics interface. An attacker can craft a malicious CSV trace file and trick an authorized technician into importing it, causing malicious code to run in their browser and execute PLC operations. This could allow unauthorized modification of industrial processes or data theft. Technologies: [Siemens SIMATIC Drive Controller CPU 1504D TF](https://junglewise.ai/threats/technologies/simatic-drive-controller-cpu-1504d-tf), [Siemens SIMATIC Drive Controller CPU 1507D TF](https://junglewise.ai/threats/technologies/simatic-drive-controller-cpu-1507d-tf), [Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN](https://junglewise.ai/threats/technologies/simatic-et-200sp-cpu-1510sp-f-1-pn), [Siemens SIMATIC ET 200SP CPU 1510SP-1 PN](https://junglewise.ai/threats/technologies/simatic-et-200sp-cpu-1510sp-1-pn), [Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN](https://junglewise.ai/threats/technologies/simatic-et-200sp-cpu-1512sp-f-1-pn), [Siemens SIMATIC ET 200SP CPU 1512SP-1 PN](https://junglewise.ai/threats/technologies/simatic-et-200sp-cpu-1512sp-1-pn), [Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN](https://junglewise.ai/threats/technologies/simatic-et-200sp-cpu-1514sp-f-2-pn), [Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC](https://junglewise.ai/threats/technologies/simatic-et-200sp-open-controller-cpu-1515sp-pc). Vendors: [Siemens](https://junglewise.ai/threats/vendors/siemens). ## Quick answers **Is CVE-2026-63351 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63351 being exploited in the wild. **How severe is CVE-2026-63351?** Medium severity, with a CVSS score of 6.1, published 13 October 2026. **Which products and versions are affected?** Siemens SIMATIC Drive Controller CPU 1504D TF all versions; Siemens SIMATIC Drive Controller CPU 1507D TF all versions; Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN all versions; Siemens SIMATIC ET 200SP CPU 1510SP-1 PN all versions; and 8 more. **Is there a fix for CVE-2026-63351?** No fixed version is recorded yet. Siemens recommends implementing network segmentation to restrict access to the web server, applying principle of least privilege to the "Read diagnostics" function right, and following the specific mitigations in SSA-591731 until patches become available. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it. **How is CVE-2026-63351 attacked?** It is attacked over the network, in a network appliance. **Am I affected by CVE-2026-63351?** Check whether you run Siemens SIMATIC Drive Controller CPU 1504D TF, Siemens SIMATIC Drive Controller CPU 1507D TF, Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## How to fix Siemens recommends implementing network segmentation to restrict access to the web server, applying principle of least privilege to the "Read diagnostics" function right, and following the specific mitigations in SSA-591731 until patches become available. ## Technical details The web server in SIMATIC S7 PLC devices fails to properly validate and sanitize visual properties of calculated signals in imported CSV trace files before rendering them on the Trace page. This enables stored cross-site scripting (XSS) where attacker-controlled JavaScript executes in the context of an authenticated user's browser session. An attacker requires social engineering to convince a user with "Read diagnostics" privilege to import a malicious file, after which the injected script can perform PLC operations within that user's authorization scope. ## Affected products - Siemens SIMATIC Drive Controller CPU 1504D TF all versions - Siemens SIMATIC Drive Controller CPU 1507D TF all versions - Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 V2 CPUs - Windows OS all versions - Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 V3 CPUs - Industrial OS all versions - Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 V3 CPUs - Windows OS all versions - Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 CPUs all versions - Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC all versions - Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN all versions - Siemens SIMATIC ET 200SP CPU 1510SP-1 PN all versions - Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN all versions - Siemens SIMATIC ET 200SP CPU 1512SP-1 PN all versions - Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN all versions ## Timeline - 2026-10-13: disclosed ## References - [https://cert-portal.siemens.com/productcert/html/ssa-591731.html](https://cert-portal.siemens.com/productcert/html/ssa-591731.html) ## Related threats - [Siemens SIMATIC S7 PLC web server cross-site scripting](https://junglewise.ai/threats/cve-2026-63357-affected-devices-do-not-properly-sanitize-calculated-signal-data) - [Siemens SIMATIC S7 PLC stored XSS in trace file import](https://junglewise.ai/threats/cve-2026-63356-affected-devices-do-not-properly-sanitize-calculated-signal-names) - [Siemens SIMATIC S7 PLCs stored XSS in trace file import](https://junglewise.ai/threats/cve-2026-63355-affected-devices-do-not-properly-sanitize-signal-names-contained) - [Siemens SIMATIC S7-1500 XSS in trace file import](https://junglewise.ai/threats/cve-2026-63354-affected-devices-do-not-properly-validate-and-sanitize-visual) - [Siemens SIMATIC S7 web server stored XSS in trace import](https://junglewise.ai/threats/cve-2026-63353-affected-devices-do-not-properly-sanitize-comment-fields)