Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-25786: Siemens SIMATIC Web Interface PLC Name Injection
CVE-2026-25786 · published 5 months ago
Summary
An attacker with access to the web interface can inject malicious code, which could be executed by authorized users who access the communication settings page. This could potentially allow the attacker to access sensitive information or take control of the system. To protect against this, ensure that all users with access to the web interface are trusted and monitor for any suspicious activity.
Original advisory text
Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface.
This could allow an authenticated attacker who is auth...
Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface.
This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page.
If a benign user with appropriate rights accesses the "communication" parameters page, the malicious code would be executed in the scope of their web session.
This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page.
If a benign user with appropriate rights accesses the "communication" parameters page, the malicious code would be executed in the scope of their web session.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published12 May 2026
Updated4 Nov 2026
First seen12 May 2026
Sources
CVE-2026-25786 · NVD
Track software like this
Free during beta