The vulnerability allows a crafted trace file, when imported via the web interface by a user with the “Read diagnostics” function right, to execute JavaScript in the browser. The injected script can then perform PLC operations within the scope of the user’s role. This creates a cross‑site scripting condition that grants an attacker the ability to control the PLC from the client side.

Siemens SIMATIC Drive Controllers (CPU 1504D TF, 1507D TF, 1515SP, 1516F etc.), SIMATIC ET 200SP and ET 200pro series (CPU 1510SP, 1512SP, 1514SPT, 1515SP, 1518SP, 1519SP, 1520SP, 1523SP), SIMATIC S7‑1500 series (CPU 1511‑1 PN, 1511C‑1 PN, 1511F‑1 PN, 1511T‑1 PN, 1511TF‑1 PN, 1512C‑1 PN, 1513‑1 PN, 1513pro F‑2 PN, 1515‑2 PN, 1515F‑2 PN, 1515T‑2 PN, 1515TF‑2 PN, 1516‑3 PN/DP, 1516F‑3 PN/DP, 1516T‑3 PN, 1516TF‑3 PN, 1517‑3 PN, 1518‑3 PN, 1518‑4 PN/DP, 1518F‑4 PN/DP, 1518T‑3 PN, 1518TF‑4 PN/DP, 1518TF‑3 PN) and associated software controller models. All user‑facing web interfaces that support trace file import are affected.

The CVSS score of 9.4 indicates a critical vulnerability. EPSS is not available and the issue is not listed in the CISA KEV catalog, but the high score reflects significant impact. Exploitation requires social engineering of an authorized user to open the malicious trace file; the attacker can then deliver arbitrary JavaScript which may instruct the PLC to perform unintended operations. The attack vector is primarily the web interface with trace‑file upload.