Siemens SIMATIC S7 PLCs Cross-Site Scripting Vulnerability in Web Interface

A cross-site scripting vulnerability has been identified in Siemens SIMATIC S7-1500 PLCs, including related ET 200 CPUs and SIPLUS variants. The issue arises because affected devices do not properly validate and sanitize Technology Object names displayed on the 'Motion Control Diagnostics' page of the web interface. This flaw could enable an authenticated attacker, authorized to download a TIA project, to inject malicious scripts. If a user with the appropriate rights accesses the 'Motion Control Diagnostics' parameters page, the injected code would execute within their web session.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's web session, potentially leading to session hijacking or credential theft.

Remediation

Siemens recommends restricting TIA project downloads to trusted personnel only. For specific product remediations, consult the Siemens Security Advisory SSA-688146.