CVE-2026-25789

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-12 · updated 2026-07-14
Weakness: CWE-79

Description

Affected devices do not properly validate and sanitize filenames on the Firmware Update page. This could allow a remote attacker to social engineer the user into selecting the modified firmware file to be uploaded. This would result in malitcious JavaScript execution in the context of the authenticated user's session without requiring the file to be uploaded, potentially leading to session hijacking or credential theft.

Affected products

Siemens SIMATIC Drive Controller CPU 1504D TF: before V3.1.6 — fixed in V3.1.6
Siemens SIMATIC Drive Controller CPU 1507D TF: before V3.1.6 — fixed in V3.1.6
Siemens SIMATIC ET 200SP CPU 1510SP-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC ET 200SP CPU 1512SP-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC ET 200SP CPU 1514SP-2 PN: before V4.1.6 — fixed in V4.1.6
Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN: before V4.1.6 — fixed in V4.1.6
Siemens SIMATIC ET 200SP CPU 1514SPT-2 PN: before V4.1.6 — fixed in V4.1.6
Siemens SIMATIC ET 200SP CPU 1514SPT F-2 PN: before V4.1.6 — fixed in V4.1.6
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V2 CPUs: all versions
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs: all versions
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 CPUs: all versions
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants): all versions
Siemens SIMATIC S7-1500 CPU 1511-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1511C-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1511F-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1511T-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1511TF-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1512C-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1513-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1513F-1 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1513pro-2 PN: before V4.1.6 — fixed in V4.1.6
Siemens SIMATIC S7-1500 CPU 1513pro F-2 PN: before V4.1.6 — fixed in V4.1.6
Siemens SIMATIC S7-1500 CPU 1515-2 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1515F-2 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1515T-2 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1515TF-2 PN: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1516-3 PN/DP: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6
Siemens SIMATIC S7-1500 CPU 1516F-3 PN/DP: before V2.9.9; before V4.1.6 — fixed in V2.9.9, V4.1.6

How to fix

Upgrade to a fixed version: Siemens SIMATIC Drive Controller CPU 1504D TF V3.1.6; Siemens SIMATIC Drive Controller CPU 1507D TF V3.1.6; Siemens SIMATIC ET 200SP CPU 1510SP-1 PN V2.9.9, V4.1.6; Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN V2.9.9, V4.1.6; Siemens SIMATIC ET 200SP CPU 1512SP-1 PN V2.9.9, V4.1.6; Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN V2.9.9, V4.1.6; Siemens SIMATIC ET 200SP CPU 1514SP-2 PN V4.1.6; Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN V4.1.6; Siemens SIMATIC ET 200SP CPU 1514SPT-2 PN V4.1.6; Siemens SIMATIC ET 200SP CPU 1514SPT F-2 PN V4.1.6; Siemens SIMATIC S7-1500 CPU 1511-1 PN V2.9.9, V4.1.6; Siemens SIMATIC S7-1500 CPU 1511C-1 PN V2.9.9, V4.1.6. Check the vendor advisory for mitigations.

References

https://cert-portal.siemens.com/productcert/html/ssa-688146.html

Get alerted when CVE-2026-25789 or the next vulnerability affects your stack