This vulnerability exists because devices fail to validate and sanitize visual properties of calculated signals that come from imported CSV trace files. An attacker who can convince an authorized user with the “Read diagnostics” permission to import a specially crafted trace file may inject arbitrary JavaScript into the Trace page. When the jQuery‑based client executes the injected script, it runs in the context of the authenticated browser session and can issue PLC commands through the web server, effectively allowing the attacker to perform operations that the user is authorized to execute.

Affected are a wide range of Siemens Model 1500 and 200SP series controllers that support CSV trace import, including CPU 1504D TF, CPU 1507D TF, a variety of ET 200SP and ET 200pro CPUs, as well as the S7‑1500 software controller families and the SIPLUS variants. All listed CPU and controller models that run either Windows or industrial operating systems are impacted.

The CVSS score of 5.3 places the threat in the medium range. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires social engineering of an authenticated user who has the Read diagnostics right; it is not remotely exploitable without user action. Once the malicious CSV is imported, the attacker’s JavaScript runs with the privileges of that user and can manipulate PLC functions via the web server.