Vulnerabilities

CVSS

7.1 High

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Risk score

56.8

Published

2026-05-12

Status

Published

Affected devices do not properly validate and sanitize filenames on the Firmware Update page. This could allow a remote attacker to social engineer the user into selecting the modified firmware file to be uploaded. This would result in malitcious JavaScript execution in the context of the authenticated user's session without requiring the file to be uploaded, potentially leading to session hijacking or credential theft.

Weaknesses

CWE-79

Coverage 1

vulnerability

Siemens SIMATIC S7 PLC Web Server

This CISA advisory details multiple vulnerabilities discovered within Siemens SIMATIC S7 PLCs, specifically within their web servers. These vulnerabilities, identified as CVE-2026-25786 through CVE-2026-25789, allow for…

CISA Advisories · May 14, 2026 Medium

CVE-2026-25786CVE-2026-25787CVE-2026-25789plcwebserverxss

All articles mentioning it

Advisories and references

• cert-portal.siemens.com/productcert/html/ssa-688146.html