The vulnerability is a stored cross‑site scripting flaw that allows an attacker to inject malicious JavaScript into a CSV trace file. When a user with the Read diagnostics function imports this file, the data is rendered on the Trace page without proper validation or sanitization. Execution of attacker‑controlled script occurs within the victim’s browser context and can be leveraged to issue PLC commands through the web server, effectively granting the attacker the same privileges as the authenticated user.

Affected Siemens SIMATIC controllers include Drive Controllers (CPU 1504D TF, CPU 1507D TF), ET 200SP series (CPU 1510SP F-1 PN, CPU 1512SP etc.), S7‑1500 series (CPU 1511‑1 PN, CPU 1516‑3 PN/DP, etc.), S7‑1500 ET 200pro (CPU 1513PRO F‑2 PN, CPU 1516PRO F‑2 PN), Siemens software controllers (1507S, 1508S, Linux variants, PLCSIM Advanced), as well as SIPLUS ET 200SP and SIPLUS S7‑1500 variants. No specific firmware or software version numbers are listed in the supplied data.

The CVSS base score is 9.4, indicating a high‑severity flaw that could lead to extensive impact. The EPSS score is unavailable, and the issue is not listed in CISA KEV, but the absence of these metrics does not reduce the risk. Successful exploitation requires social engineering an authorized user holding the Read diagnostics right to import a specially crafted CSV trace file. Once the file is imported, attacker‑controlled JavaScript executes in the victim’s browser and can interact with the PLC via the web server, providing the attacker with the same level of access as the victim. This represents a significant operational risk in industrial settings where such controllers are common.