CVE-2026-63352: Siemens SIMATIC S7-1500 web server XSS via CSV trace import

CVE-2026-63352 · Severity: medium · CVSS 6.1 · Published 2026-10-13

Siemens SIMATIC S7-1500 PLCs and related controllers contain a cross-site scripting vulnerability in their web server's trace file import feature. An attacker could trick an authorized user into importing a malicious CSV trace file, allowing the attacker to execute JavaScript code in the user's browser and perform PLC operations. This could result in unauthorized control of industrial automation systems or manipulation of production processes.

Technologies: Siemens SIMATIC Drive Controller CPU 1504D TF, Siemens SIMATIC Drive Controller CPU 1507D TF, Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN, Siemens SIMATIC ET 200SP CPU 1510SP-1 PN, Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN, Siemens SIMATIC ET 200SP CPU 1512SP-1 PN, Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN, Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2, Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4. Vendors: Siemens.

Quick answers

Is CVE-2026-63352 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63352 being exploited in the wild.
How severe is CVE-2026-63352?
Medium severity, with a CVSS score of 6.1, published 13 October 2026.
Which products and versions are affected?
Siemens SIMATIC Drive Controller CPU 1504D TF All versions; Siemens SIMATIC Drive Controller CPU 1507D TF All versions; Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN All versions; Siemens SIMATIC ET 200SP CPU 1510SP-1 PN All versions; and 5 more.
Is there a fix for CVE-2026-63352?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-63352 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-63352?
Check whether you run Siemens SIMATIC Drive Controller CPU 1504D TF, Siemens SIMATIC Drive Controller CPU 1507D TF, Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the Trace page where calculated signal data from imported CSV files is not properly sanitized before rendering. An attacker requires the target user to hold the "Read diagnostics" function right and must socially engineer them into importing a crafted CSV file. Once exploited, JavaScript executes in the user's browser session with the privileges of that user, allowing PLC operations through the web server.

Affected products

  • Siemens SIMATIC Drive Controller CPU 1504D TF All versions
  • Siemens SIMATIC Drive Controller CPU 1507D TF All versions
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 All versions
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 All versions
  • Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN All versions
  • Siemens SIMATIC ET 200SP CPU 1510SP-1 PN All versions
  • Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN All versions
  • Siemens SIMATIC ET 200SP CPU 1512SP-1 PN All versions
  • Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN All versions

Timeline

  • 2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.