CVE-2026-25787

Description

Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page. If a benign user with appropriate rights accesses the "Motion Control Diagnostics" parameters page, the malicious code would be executed in the scope of their web session.

PUBLISHED Reserved 2026-02-05 | Published 2026-05-12 | Updated 2026-05-12 | Assigner siemens

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

References

cert-portal.siemens.com/productcert/html/ssa-688146.html

cve.org (CVE-2026-25787)

nvd.nist.gov (CVE-2026-25787)

Download JSON