Back to the CVE list
CVE-2026-63354

Cross-site scripting in Siemens SIMATIC Drive Controller CPU 1504D TF

CVSS score

9.6

EPSS probability

—

Risk score

1.0

Published

13 h ago

OverviewPublic Exploits (0)NewsroomVulnerability Timeline
Patch status has not yet been verified

Resmî kaynaklarda yeterli kanıt bulunamadı. Bu sonuç “yama yok” anlamına gelmez.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

CVE AI research

The stored explanation is shown at once; refreshing evaluates the sources again.

DayBreach AI Explanation

Verified against sources

Cross-Site Scripting Vulnerability in Siemens SIMATIC Drive Controller CPU 1504D TF

Sources read

2

Source agreement

Tam uyum

Evidence confidence

%63

Short explanation

A cross-site scripting vulnerability exists in Siemens SIMATIC Drive Controller CPU 1504D TF and related products due to improper validation of visual marker data in imported CSV trace files.

Why does it matter?

This critical vulnerability allows attackers to target authorized users and execute PLC operations through the web server within the user's authorization scope by running attacker-controlled JavaScript in browser sessions.

What should be done?

  • Follow vendor advisories and security guidance
  • Avoid importing CSV trace files from untrusted sources
  • Strictly audit user privileges and function rights
Chain of evidence and sources3 verified claims

Etkilenen cihazlar, içe aktarılan CSV izleme dosyalarındaki görsel işaretçi verilerini Trace sayfasında sunmadan önce düzgün bir şekilde doğrulamamaktadır.

S0 · daybreach-canonicalS1 · cvelistS2 · nvd

Başarılı istismar, saldırgan kontrolündeki JavaScript'in kullanıcının tarayıcı oturumunda çalışmasına ve PLC işlemleri gerçekleştirmesine izin verebilir.

S0 · daybreach-canonicalS1 · cvelistS2 · nvd

Zafiyetin CVSS taban puanı 9.6 olup kritik seviyededir.

S0 · daybreach-canonicalS1 · cvelistS2 · nvd
Show the technical text from the sources

Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CWE: CWE-79

Explanation produced with the local gemini-flash-lite-latest model. Numerical metrics and the KEV, patch and exploit statuses are not determined by AI.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2026-63354 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

IDVENDORPRODUCTACTION
1siemensSIMATIC Drive Controller CPU 1504D TF View
2siemensSIMATIC Drive Controller CPU 1507D TF View
3siemensSIMATIC ET 200SP CPU 1510SP F-1 PN View
4siemensSIMATIC ET 200SP CPU 1510SP-1 PN View
5siemensSIMATIC ET 200SP CPU 1512SP F-1 PN View
6siemensSIMATIC ET 200SP CPU 1512SP-1 PN View
7siemensSIMATIC ET 200SP CPU 1514SP F-2 PN View
8siemensSIMATIC ET 200SP CPU 1514SP-2 PN View
9siemensSIMATIC ET 200SP CPU 1514SPT F-2 PN View
10siemensSIMATIC ET 200SP CPU 1514SPT-2 PN View
11siemensSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) View
12siemensSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V2 CPUs - Windows OS View
13siemensSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Industrial OS View
14siemensSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Windows OS View
15siemensSIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 CPUs View
16siemensSIMATIC S7-1500 CPU 1511-1 PN View
17siemensSIMATIC S7-1500 CPU 1511C-1 PN View
18siemensSIMATIC S7-1500 CPU 1511F-1 PN View
19siemensSIMATIC S7-1500 CPU 1511T-1 PN View
20siemensSIMATIC S7-1500 CPU 1511TF-1 PN View
21siemensSIMATIC S7-1500 CPU 1512C-1 PN View
22siemensSIMATIC S7-1500 CPU 1513-1 PN View
23siemensSIMATIC S7-1500 CPU 1513F-1 PN View
24siemensSIMATIC S7-1500 CPU 1513pro F-2 PN View
25siemensSIMATIC S7-1500 CPU 1513pro-2 PN View
26siemensSIMATIC S7-1500 CPU 1515-2 PN View
27siemensSIMATIC S7-1500 CPU 1515F-2 PN View
28siemensSIMATIC S7-1500 CPU 1515T-2 PN View
29siemensSIMATIC S7-1500 CPU 1515TF-2 PN View
30siemensSIMATIC S7-1500 CPU 1516-3 PN/DP View
31siemensSIMATIC S7-1500 CPU 1516F-3 PN/DP View
32siemensSIMATIC S7-1500 CPU 1516pro F-2 PN View
33siemensSIMATIC S7-1500 CPU 1516pro-2 PN View
34siemensSIMATIC S7-1500 CPU 1516T-3 PN View
35siemensSIMATIC S7-1500 CPU 1516T-3 PN/DP View
36siemensSIMATIC S7-1500 CPU 1516TF-3 PN View
37siemensSIMATIC S7-1500 CPU 1516TF-3 PN/DP View
38siemensSIMATIC S7-1500 CPU 1517-3 PN View
39siemensSIMATIC S7-1500 CPU 1517-3 PN/DP View
40siemensSIMATIC S7-1500 CPU 1517F-3 PN View
41siemensSIMATIC S7-1500 CPU 1517F-3 PN/DP View
42siemensSIMATIC S7-1500 CPU 1517T-3 PN View
43siemensSIMATIC S7-1500 CPU 1517T-3 PN/DP View
44siemensSIMATIC S7-1500 CPU 1517TF-3 PN View
45siemensSIMATIC S7-1500 CPU 1517TF-3 PN/DP View
46siemensSIMATIC S7-1500 CPU 1518-3 PN View
47siemensSIMATIC S7-1500 CPU 1518-4 PN/DP View
48siemenssimatic s7-1500 cpu 1518-4 pn/dp mfp View
49siemensSIMATIC S7-1500 CPU 1518F-3 PN View
50siemensSIMATIC S7-1500 CPU 1518F-4 PN/DP View
51siemenssimatic s7-1500 cpu 1518f-4 pn/dp mfp View
52siemensSIMATIC S7-1500 CPU 1518T-3 PN View
53siemensSIMATIC S7-1500 CPU 1518T-4 PN/DP View
54siemensSIMATIC S7-1500 CPU 1518TF-3 PN View
55siemensSIMATIC S7-1500 CPU 1518TF-4 PN/DP View
56siemensSIMATIC S7-1500 CPU S7-1518-4 PN/DP ODK View
57siemensSIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODK View
58siemensSIMATIC S7-1500 ET 200pro: CPU 1513PRO F-2 PN View
59siemensSIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PN View
60siemensSIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PN View
61siemensSIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PN View
62siemensSIMATIC S7-1500 Software Controller CPU 1507S F V2 View
63siemensSIMATIC S7-1500 Software Controller CPU 1507S F V3 View
64siemensSIMATIC S7-1500 Software Controller CPU 1507S F V4 View
65siemensSIMATIC S7-1500 Software Controller CPU 1507S V2 View
66siemensSIMATIC S7-1500 Software Controller CPU 1507S V3 View
67siemensSIMATIC S7-1500 Software Controller CPU 1507S V4 View
68siemensSIMATIC S7-1500 Software Controller CPU 1508S F V2 View
69siemensSIMATIC S7-1500 Software Controller CPU 1508S F V3 View
70siemensSIMATIC S7-1500 Software Controller CPU 1508S F V4 View
71siemensSIMATIC S7-1500 Software Controller CPU 1508S T V3 View
72siemensSIMATIC S7-1500 Software Controller CPU 1508S TF V3 View
73siemensSIMATIC S7-1500 Software Controller CPU 1508S V2 View
74siemensSIMATIC S7-1500 Software Controller CPU 1508S V3 View
75siemensSIMATIC S7-1500 Software Controller CPU 1508S V4 View
76siemensSIMATIC S7-1500 Software Controller Linux V2 View
77siemensSIMATIC S7-1500 Software Controller Linux V3 View
78siemensSIMATIC S7-PLCSIM Advanced View
79siemensSIPLUS ET 200SP CPU 1510SP F-1 PN View
80siemensSIPLUS ET 200SP CPU 1510SP F-1 PN RAIL View
81siemensSIPLUS ET 200SP CPU 1510SP-1 PN View
82siemensSIPLUS ET 200SP CPU 1510SP-1 PN RAIL View
83siemensSIPLUS ET 200SP CPU 1512SP F-1 PN View
84siemensSIPLUS ET 200SP CPU 1512SP F-1 PN RAIL View
85siemensSIPLUS ET 200SP CPU 1512SP-1 PN View
86siemensSIPLUS ET 200SP CPU 1512SP-1 PN RAIL View
87siemensSIPLUS S7-1500 CPU 1511-1 PN View
88siemensSIPLUS S7-1500 CPU 1511-1 PN T1 RAIL View
89siemensSIPLUS S7-1500 CPU 1511-1 PN TX RAIL View
90siemensSIPLUS S7-1500 CPU 1511F-1 PN View
91siemensSIPLUS S7-1500 CPU 1513-1 PN View
92siemensSIPLUS S7-1500 CPU 1513F-1 PN View
93siemensSIPLUS S7-1500 CPU 1515F-2 PN View
94siemensSIPLUS S7-1500 CPU 1515F-2 PN RAIL View
95siemensSIPLUS S7-1500 CPU 1515F-2 PN T2 RAIL View
96siemensSIPLUS S7-1500 CPU 1516-3 PN/DP View
97siemensSIPLUS S7-1500 CPU 1516-3 PN/DP RAIL View
98siemensSIPLUS S7-1500 CPU 1516-3 PN/DP TX RAIL View
99siemensSIPLUS S7-1500 CPU 1516F-3 PN/DP View
100siemensSIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL View
101siemensSIPLUS S7-1500 CPU 1518-4 PN/DP View
102siemenssiplus s7-1500 cpu 1518-4 pn/dp mfp View
103siemensSIPLUS S7-1500 CPU 1518F-4 PN/DP View
Total affected vendors: 1|Products: 103

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCOREVERSIONSEVERITYVECTORSOURCE
9.6CVSS V3_1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HCVE CNA
9.6CVSS V31CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HNVD
9.4CVSS V4_0CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HCVE CNA
9.4CVSS V40CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD

Patch and Remediation Guide

Solution & Remediation Advisory

Patch status unknown

İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.

Confirm the affected product and version against the source evidence above.
Restrict access to internet-facing services and apply network segmentation.
Until a patch is confirmed, follow the vendor advisory; do not read an unknown status as “no patch”.
Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-63354 is associated with the following CWEs:

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-63354 weaknesses.

CAPEC-66: SQL InjectionCAPEC-126: Path TraversalCAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureAğ üzerinden
PermissionsGerekmiyor
UserGerekiyor

Official Sources and Advisories

https://cert-portal.siemens.com/productcert/html/ssa-591731.htmlvendor-advisory

CVSS Vector Radar Chart

9.6 / 10
Attack VectorNetworkComplexityLowPrivilegesNoneUser Interact.RequiredConfidentialityLowIntegrityHighAvailabilityHigh

Vulnerability Scoring Details

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone required
User Interaction—
Confidentiality (Gizlilik)Low
Integrity (Bütünlük)High
Availability (Erişilebilirlik)High

Yama durumu bilinmiyor

İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.

Follow the vendor

S
siemens logo
siemens

Weakness Type (CWE & CAPEC)

CWE-79

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-63354"