CVE-2026-63353: Siemens SIMATIC S7 web server stored XSS in trace import

CVE-2026-63353 · Severity: critical · CVSS 9.6 · Published 2026-10-13

Siemens SIMATIC S7 programmable logic controllers (industrial automation devices) fail to sanitize comment fields in imported trace files, allowing attackers to inject malicious JavaScript. An attacker can trick an authorized user into importing a crafted trace file, leading to arbitrary code execution in the user's browser and unauthorized control of the PLC system within that user's permissions.

Technologies: Siemens SIMATIC Drive Controller CPU 1504D TF, Siemens SIMATIC Drive Controller CPU 1507D TF, Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN, Siemens SIMATIC ET 200SP CPU 1510SP-1 PN, Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN, Siemens SIMATIC ET 200SP CPU 1512SP-1 PN, Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN, Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC, Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2, Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4. Vendors: Siemens.

Quick answers

Is CVE-2026-63353 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63353 being exploited in the wild.
How severe is CVE-2026-63353?
Critical severity, with a CVSS score of 9.6, published 13 October 2026.
Which products and versions are affected?
Siemens SIMATIC Drive Controller CPU 1504D TF all versions; Siemens SIMATIC Drive Controller CPU 1507D TF all versions; Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN all versions; Siemens SIMATIC ET 200SP CPU 1510SP-1 PN all versions; and 6 more.
Is there a fix for CVE-2026-63353?
No fixed version is recorded yet. Siemens recommends restricting access to the web interface and limiting users who hold the "Read diagnostics" function right. Avoid importing trace files from untrusted sources until patches are available. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-63353 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-63353?
Check whether you run Siemens SIMATIC Drive Controller CPU 1504D TF, Siemens SIMATIC Drive Controller CPU 1507D TF, Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Siemens recommends restricting access to the web interface and limiting users who hold the "Read diagnostics" function right. Avoid importing trace files from untrusted sources until patches are available.

Technical details

The web server does not properly sanitize comment fields before rendering them on the Trace page, enabling stored cross-site scripting (XSS). The attack requires user interaction (importing a file) and the victim must hold the "Read diagnostics" function right. Successful exploitation allows execution of arbitrary JavaScript in the authenticated user's session, enabling PLC operations such as configuration changes or process manipulation.

Affected products

  • Siemens SIMATIC Drive Controller CPU 1504D TF all versions
  • Siemens SIMATIC Drive Controller CPU 1507D TF all versions
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 all versions
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 all versions
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC all versions
  • Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN all versions
  • Siemens SIMATIC ET 200SP CPU 1510SP-1 PN all versions
  • Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN all versions
  • Siemens SIMATIC ET 200SP CPU 1512SP-1 PN all versions
  • Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN all versions

Timeline

  • 2026-10-13: disclosed: Siemens advisory SSA-591731 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.