Executable Content Vulnerability in Siemens Products
CVE-2026-63350

9.4CRITICAL

Key Information:

Vendor

Siemens
Status
Simatic Drive Controller Cpu 1504d Tf
Simatic Drive Controller Cpu 1507d Tf
Simatic Et 200sp Cpu 1510sp F-1 Pn
Simatic Et 200sp Cpu 1510sp-1 Pn
Vendor
CVE Published:
13 October 2026

What is CVE-2026-63350?

This vulnerability arises from the failure of Siemens PLCs to adequately restrict executable content in imported trace files. Attackers could exploit this flaw by social engineering an authorized user into importing a specially crafted trace file. If exploited successfully, this vulnerability enables attacker-controlled JavaScript to execute within the user’s browser session, allowing unauthorized operations on the PLC through the web server, effectively bypassing the user's authorization controls.

Affected Version(s)

SIMATIC Drive Controller CPU 1504D TF 0

SIMATIC Drive Controller CPU 1507D TF 0

SIMATIC ET 200SP CPU 1510SP F-1 PN 0

References

https://cert-portal.siemens.com/productcert/html/ssa-5917...

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.