An attacker can craft a CSV trace file whose calculated signal names contain malicious JavaScript and cause those names to appear in an error message on the Trace page of certain Siemens controllers. When an authorized user with the "Read diagnostics" privilege opens that page, the browser interprets the injected code and executes it in the user’s session. This allows arbitrary script execution that could lead to credential theft, session hijacking or other actions performed by the user’s browser.

The vulnerability affects a wide range of Siemens SIMATIC product families, including Drive Controllers such as the CPU 1504D TF and CPU 1507D TF, various ET 200SP and Open Controller CPUs (1510SP, 1512SP, 1514SP, 1515SP, 1516SP, 1517SP, 1518SP and their P versions), S7‑1500 CPUs (1511–1518 series) and related software controllers and simulators across both Windows and Industrial operating systems.

The CVSS score of 5.3 indicates moderate impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits yet. Nevertheless, because the flaw requires the victim to be an authorized user with read‑diagnostics rights, the attack vector is social engineering. An attacker can lure a user into uploading a malicious trace file and then trigger the error page to run arbitrary JavaScript in the user’s browser session.