PT-2026-39984 · Siemens · Simatic

Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-25786

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC (affected versions not specified)

Description Devices fail to properly validate and sanitize the PLC/station name rendered on the "communication" parameters page of the web interface. An authenticated attacker with authorization to download a TIA project into the product can inject malicious scripts into this page. When a user with appropriate permissions accesses the "communication" parameters page, the injected code executes within the context of their web session. This is a Cross-Site Scripting (XSS) issue, where malicious scripts are injected into otherwise trusted websites.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-25786

Affected Products

Simatic

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-25786 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-688146.html · Note
• https://t.me/CVEtracker/53476 · Telegram Post
• https://reddit.com/r/pwnhub/comments/1tb2e83/critical_xss_vulnerability_found_in_plc_devices · Reddit Post