CVE-2026-25786: Siemens SIMATIC Drive Controller CPU 1504d Tf
Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days.
Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page. If a benign user with appropriate rights accesses the "communication" parameters page, the malicious code would be executed in the scope of their web session.
Affected products
- Siemens SIMATIC Drive Controller CPU 1504d Tf: before V3.1.6 (fixed in V3.1.6)
- Siemens SIMATIC Drive Controller CPU 1507d Tf: before V3.1.6 (fixed in V3.1.6)
- Siemens SIMATIC Et 200sp CPU 1510sp-1 Pn: any version; before V2.9.9 (fixed in V2.9.9); before V4.1.6 (fixed in V4.1.6)
- Siemens SIMATIC Et 200sp CPU 1510sp F-1 Pn: any version; before V2.9.9 (fixed in V2.9.9); before V4.1.6 (fixed in V4.1.6)
- Siemens SIMATIC Et 200sp CPU 1512sp-1 Pn: any version; before V2.9.9 (fixed in V2.9.9); before V4.1.6 (fixed in V4.1.6)
- Siemens SIMATIC Et 200sp CPU 1512sp F-1 Pn: any version; before V2.9.9 (fixed in V2.9.9); before V4.1.6 (fixed in V4.1.6)
- Siemens SIMATIC Et 200sp CPU 1514sp-2 Pn: before V4.1.6 (fixed in V4.1.6)
- Siemens SIMATIC Et 200sp CPU 1514sp F-2 Pn: before V4.1.6 (fixed in V4.1.6)
- Siemens SIMATIC Et 200sp CPU 1514spt-2 Pn: before V4.1.6 (fixed in V4.1.6)
- Siemens SIMATIC Et 200sp CPU 1514spt F-2 Pn: before V4.1.6 (fixed in V4.1.6)
- Siemens SIMATIC Et 200sp Open Controller CPU 1515sp PC2 Incl. Siplus Variants v2 Cpus: any version
- Siemens SIMATIC Et 200sp Open Controller CPU 1515sp PC2 Incl. Siplus Variants v3 Cpus: any version
- Siemens SIMATIC Et 200sp Open Controller CPU 1515sp PC3 v4 Cpus: any version
- Siemens SIMATIC Et 200sp Open Controller CPU 1515sp Pc Incl. Siplus Variants: any version
- Siemens SIMATIC s7-1500 CPU 1511-1 Pn: any version; before V2.9.9 (fixed in V2.9.9); before V4.1.6 (fixed in V4.1.6)
- Siemens SIMATIC s7-1500 CPU 1511c-1 Pn: before V2.9.9 (fixed in V2.9.9); before V4.1.6 (fixed in V4.1.6)
- Siemens SIMATIC s7-1500 CPU 1511f-1 Pn: any version; before V2.9.9 (fixed in V2.9.9); before V4.1.6 (fixed in V4.1.6)
- Siemens SIMATIC s7-1500 CPU 1511t-1 Pn: before V2.9.9 (fixed in V2.9.9); before V4.1.6 (fixed in V4.1.6)
- Siemens SIMATIC s7-1500 CPU 1511tf-1 Pn: before V2.9.9 (fixed in V2.9.9); before V4.1.6 (fixed in V4.1.6)
- Siemens SIMATIC s7-1500 CPU 1512c-1 Pn: before V2.9.9 (fixed in V2.9.9); before V4.1.6 (fixed in V4.1.6)
- Siemens SIMATIC s7-1500 CPU 1513-1 Pn: any version; before V2.9.9 (fixed in V2.9.9); before V4.1.6 (fixed in V4.1.6)
- Siemens SIMATIC s7-1500 CPU 1513f-1 Pn: any version; before V2.9.9 (fixed in V2.9.9); before V4.1.6 (fixed in V4.1.6)
- Siemens SIMATIC s7-1500 CPU 1513pro-2 Pn: before V4.1.6 (fixed in V4.1.6)
- Siemens SIMATIC s7-1500 CPU 1513pro F-2 Pn: before V4.1.6 (fixed in V4.1.6)
- Siemens SIMATIC s7-1500 CPU 1515-2 Pn: any version; before V2.9.9 (fixed in V2.9.9); before V4.1.6 (fixed in V4.1.6)
- and 77 more
Published 2026-05-12. Last modified 2026-07-14.