CVE-2026-25786

View on CVE.org
Published May 12, 2026 CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Description
Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface.
This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page.
If a benign user with appropriate rights accesses the "communication" parameters page, the malicious code would be executed in the scope of their web session.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page. If a benign user with appropriate rights accesses the "communication" parameters page, the malicious code would be executed in the scope of their web session.
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

No data.

Weaknesses

Sources

Status
PUBLISHED
Assigner
siemens
Published
Updated
Jul 14, 2026, 9:19 AM
Reserved
Feb 5, 2026, 7:53 PM

View source JSON

Updated
May 12, 2026, 12:42 PM

JSON

Status
Awaiting Analysis
Published
May 12, 2026, 10:16 AM
Modified
Jul 14, 2026, 10:16 AM

View source JSON

No data.

Updated
May 12, 2026, 10:30 AM

JSON