CVE-2026-63355: Siemens SIMATIC S7 PLCs stored XSS in trace file import

CVE-2026-63355 · Severity: medium · CVSS 6.1 · Published 2026-10-13

Siemens SIMATIC S7 industrial controller web servers fail to sanitize signal names in imported CSV trace files, allowing malicious JavaScript execution in a user's browser. An attacker can social engineer an authorized diagnostic user into opening a crafted trace file, then execute arbitrary code with the user's privileges when they interact with the trace selection menu, potentially leading to PLC operations or data manipulation.

Technologies: Siemens SIMATIC Drive Controller CPU 1504D TF, Siemens SIMATIC Drive Controller CPU 1507D TF, Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN, Siemens SIMATIC ET 200SP CPU 1510SP-1 PN, Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN, Siemens SIMATIC ET 200SP CPU 1512SP-1 PN, Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN, Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2, Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4. Vendors: Siemens.

Quick answers

Is CVE-2026-63355 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63355 being exploited in the wild.
How severe is CVE-2026-63355?
Medium severity, with a CVSS score of 6.1, published 13 October 2026.
Which products and versions are affected?
Siemens SIMATIC Drive Controller CPU 1504D TF all versions; Siemens SIMATIC Drive Controller CPU 1507D TF all versions; Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN all versions; Siemens SIMATIC ET 200SP CPU 1510SP-1 PN all versions; and 5 more.
Is there a fix for CVE-2026-63355?
No fixed version is recorded yet. No fix is currently available. Siemens recommends restricting web interface access to trusted networks and users, disabling remote web access where not operationally required, and educating authorized users to avoid importing trace files from untrusted sources. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-63355 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-63355?
Check whether you run Siemens SIMATIC Drive Controller CPU 1504D TF, Siemens SIMATIC Drive Controller CPU 1507D TF, Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

No fix is currently available. Siemens recommends restricting web interface access to trusted networks and users, disabling remote web access where not operationally required, and educating authorized users to avoid importing trace files from untrusted sources.

Technical details

Unsanitized signal names from CSV trace file imports are rendered directly in selection menu HTML on the Trace page, enabling stored XSS. The attack requires user interaction: an authorized user with "Read diagnostics" function rights must import a malicious CSV file and then interact with the affected menu. Attackers can execute browser-context code within the PLC's web interface, potentially performing PLC operations under the victim's authorization scope.

Affected products

  • Siemens SIMATIC Drive Controller CPU 1504D TF all versions
  • Siemens SIMATIC Drive Controller CPU 1507D TF all versions
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 all versions
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 all versions
  • Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN all versions
  • Siemens SIMATIC ET 200SP CPU 1510SP-1 PN all versions
  • Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN all versions
  • Siemens SIMATIC ET 200SP CPU 1512SP-1 PN all versions
  • Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN all versions

Timeline

  • 2026-10-13: disclosed
  • 2026-10-13: advisory: Siemens SSA-591731

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.