A flaw in Siemens’ PLC web interface allows attackers to leverage unsanitized comment fields embedded in imported trace files. When a privileged user possessing the ‘Read diagnostics’ function uploads a specially crafted trace file, the web server renders the malicious content within the Trace page, leading to execution of attacker‑controlled JavaScript in the user’s browser session. This stored cross‑site scripting (XSS) can be used to send commands to the PLC through the web server, effectively giving the attacker the same authority as the authenticated user.

The vulnerability affects a broad range of Siemens PLC controllers, including SIMATIC Drive Controller CPUs (1504D TF, 1507D TF, 1510SP, 1512SP, 1514SP, 1515SP, 1516SP, 1518SP, etc.), SIMATIC ET 200SP Open Controller models, and SIMATIC S7‑1500 series CPUs and software controllers. All listed CPU models that accept trace files and render comment fields through the Trace page are susceptible.

With a CVSS score of 9.4, the issue is classified as critical. Although the EPSS score is not available and the vulnerability is not currently listed in the CISA KEV catalog, the high severity and the need for user authentication with diagnostic privileges make it a high‑risk exploit vector. An attacker who can persuade an authorized user to import a malicious trace file can execute arbitrary JavaScript, which could in turn trigger PLC control commands and compromise system integrity.