PT-2026-39985 · Siemens · Simatic Wincc

Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-25787

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC (affected versions not specified)

Description Devices fail to properly validate and sanitize the Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface. This allows an authenticated attacker with permissions to download a TIA project into the product to inject malicious scripts into the page. When a user with appropriate rights accesses the "Motion Control Diagnostics" parameters page, the malicious code executes within the context of their web session. This is a Cross-Site Scripting (XSS) issue, where an attacker injects client-side scripts into web pages viewed by other users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-25787

Affected Products

Simatic Wincc

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-25787 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-688146.html · Note
• https://reddit.com/r/pwnhub/comments/1tb2ei2/critical_xss_vulnerability_discovered_in_motion · Reddit Post
• https://t.me/CVEtracker/53477 · Telegram Post