This flaw, a type of unvalidated input leading to client‑side XSS (CWE‑79), causes user‑supplied signal names from imported CSV trace files to be rendered unsanitized, allowing embedded JavaScript to execute when an authorized user with the ‘Read diagnostics’ right interacts with selection menus; this client‑side XSS can result in session hijacking, credential theft, or other malicious actions executed within the user’s browser.

Siemens SIMATIC Drive Controller CPUs (1504D TF, 1507D TF, 1510SP–1514SP series and variants), ET 200SP CPUs (1510SP–1514SP and Open Controller 1515SP/PC variants, and SIPLUS monitoring units), the S7‑1500 line of CPUs (1511‑1 through 1518‑4, including C‑, F‑, T‑, and TF‑models), SIMATIC S7‑1500 Software Controllers (1507S, 1508S series, Linux V2/V3, and advanced PLCSim models), and SIPLUS S7‑1500 versions are all affected.

With a CVSS score of 5.3 the vulnerability is of moderate severity. The EPSS score is not available, making precise exploitation probability difficult, and it is not listed in the CISA KEV catalog, indicating no known large‑scale attacks. Nevertheless, the flaw requires social engineering to entice a legitimate user with ‘Read diagnostics’ rights to import a crafted CSV file, which presents a real risk in environments where those permissions are granted.