CVE-2026-25787

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-12 · updated 2026-07-14
Weakness: CWE-79

Description

Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page. If a benign user with appropriate rights accesses the "Motion Control Diagnostics" parameters page, the malicious code would be executed in the scope of their web session.

Affected products

Siemens SIMATIC Drive Controller CPU 1504D TF: before V3.1.6 — fixed in V3.1.6
Siemens SIMATIC Drive Controller CPU 1507D TF: before V3.1.6 — fixed in V3.1.6
Siemens SIMATIC ET 200SP CPU 1510SP-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC ET 200SP CPU 1512SP-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC ET 200SP CPU 1514SP-2 PN: before V4.1.6 — fixed in V4.1.6
Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN: before V4.1.6 — fixed in V4.1.6
Siemens SIMATIC ET 200SP CPU 1514SPT-2 PN: before V4.1.6 — fixed in V4.1.6
Siemens SIMATIC ET 200SP CPU 1514SPT F-2 PN: before V4.1.6 — fixed in V4.1.6
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V2 CPUs: all versions
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs: all versions
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 CPUs: all versions
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants): all versions
Siemens SIMATIC S7-1500 CPU 1511-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1511C-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1511F-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1511T-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1511TF-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1512C-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1513-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1513F-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1513pro-2 PN: before V4.1.6 — fixed in V4.1.6
Siemens SIMATIC S7-1500 CPU 1513pro F-2 PN: before V4.1.6 — fixed in V4.1.6
Siemens SIMATIC S7-1500 CPU 1515-2 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1515F-2 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1515T-2 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1515TF-2 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1516-3 PN/DP: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1516F-3 PN/DP: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6

How to fix

Upgrade to a fixed version: Siemens SIMATIC Drive Controller CPU 1504D TF V3.1.6; Siemens SIMATIC Drive Controller CPU 1507D TF V3.1.6; Siemens SIMATIC ET 200SP CPU 1510SP-1 PN V2.9.9, V4.1.6; Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN V2.9.9, V4.1.6; Siemens SIMATIC ET 200SP CPU 1512SP-1 PN V2.9.9, V4.1.6; Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN V2.9.9, V4.1.6; Siemens SIMATIC ET 200SP CPU 1514SP-2 PN V4.1.6; Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN V4.1.6; Siemens SIMATIC ET 200SP CPU 1514SPT-2 PN V4.1.6; Siemens SIMATIC ET 200SP CPU 1514SPT F-2 PN V4.1.6; Siemens SIMATIC S7-1500 CPU 1511-1 PN V2.9.9, V4.1.6; Siemens SIMATIC S7-1500 CPU 1511C-1 PN V2.9.9, V4.1.6. Check the vendor advisory for mitigations.

References

https://cert-portal.siemens.com/productcert/html/ssa-688146.html

Get alerted when CVE-2026-25787 or the next vulnerability affects your stack