Affected Siemens devices do not sanitize calculated signal data in imported calculated signal files before rendering on the Trace page. An attacker who can trick an authorized user with the Read diagnostics function to import a specially crafted file can inject malicious JavaScript. The script runs in the user’s browser context and can use the web server to issue PLC commands, effectively giving the attacker control over the connected devices.

The vulnerability impacts a broad range of Siemens SIMATIC hardware and software, including Drive Controller CPUs 1504D TF, 1507D TF, various ET 200SP and ET 200SP Open Controller CPUs (such as 1510‑15SP, 1512SP, 1514SP, 1515SP PC, etc.), the S7‑1500 series (including CPUs 1511‑1 PN, 1512C‑1 PN, 1515‑2 PN, 1516‑3 PN, 1518‑4 PN/DP and several other variants), software controllers for CPUs 1507S and 1508S (both industrial and Windows OS), Linux-based Software Controllers, S7‑PLCSIM Advanced, and SIPLUS variants. All listed products are affected unless a specific update is applied.

The CVSS score of 5.3 denotes moderate severity. Because exploitation requires social engineering of a legitimate user with the Read diagnostics permission and the attack vector is internal browser‑based, the likelihood of widespread exploitation is lower than a remotely exploitable flaw, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalogue, indicating it has not been widely abused yet; nevertheless, the ability to execute arbitrary JavaScript and control PLC operations warrants timely remediation.