CVE-2026-25786

Katalog CVE

CVSS 9.1 · Critical EPSS 0,54%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Skor CVSS 3.1 9.1 (Critical) menurut siemens.com.

Deskripsi (NVD)

Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page. If a benign user with appropriate rights accesses the "communication" parameters page, the malicious code would be executed in the scope of their web session.

Rincian

Terbit di NVD

12 Mei 2026

Terakhir diubah

14 Juli 2026

Status NVD

Awaiting Analysis

CVSS 3.1

9.1 (Critical), sumber siemens.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 43,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://cert-portal.siemens.com/productcert/html/ssa-688146.html