The vulnerability results from inadequate sanitization of signal data in CSV trace files that are imported and rendered on the Trace page. An attacker can craft a CSV file containing malicious JavaScript and rely on a legitimate user with the “Read diagnostics” right to import it. When the imported trace is viewed, the embedded script runs within the browser session of the authorized user, enabling the attacker to execute arbitrary commands in the context of that user, including potentially controlling PLC operations through the web server.

The issue applies to a wide range of Siemens devices documented as SIMATIC Drive Controllers, ET 200SP and Open Controller variants, S7‑1500 CPUs, and S7‑200PCs, among others. No specific firmware or firmware‑building versions are provided, so the vulnerability may affect any currently running firmware that has not incorporated the required input‑sanitization fix.

With a CVSS score of 5.3 the severity is moderate, and the EPSS score is not available, while the vulnerability is not listed in the CISA KEV catalog. Exploitation demands that an attacker social engineer an authorized user to import the crafted trace file; it does not require remote code execution on the device itself. Therefore the risk hinges on the likelihood of successful social engineering and the presence of the exposed import functionality, making the overall risk moderate but still actionable.