Siemens SIMATIC Drive Controller CPU 1504D TF

CVE-2026-63356

MEDIUM 5.3

En bref

Source: NVD
EPSS: EPSS 0.19 % · centile 8 (2026-10-29)
État: PUBLISHED
Publiée: 2026-10-13 09:18 UTC
Mise à jour: 2026-10-13 16:20 UTC
Attribuée par: siemens
Statut NVD: Awaiting Analysis

Rechercher sur…

Description

Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user’s browser session when the resulting error message is displayed.

Faiblesses (CWE)

CWE-79 — Injection de code indirecte (XSS)

Références

https://cert-portal.siemens.com/productcert/html/ssa-591731.html

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	siemens
CVSS 4.0	MEDIUM 5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N	siemens
CVSS 4.0	MEDIUM 5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · productcert@siemens.com (Secondary)
CVSS 3.1	MEDIUM 6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	NVD · productcert@siemens.com (Secondary)

Références européennes

ENISA EUVD · EUVD-2026-98387
GCVE · GCVE-0-2026-63356

Avis du CERT-FR

CERTFR-2026-AVI-1298 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr

Produits affectés

Produit	Versions
Siemens · SIMATIC Drive Controller CPU 1504D TF	affected 0 < *
Siemens · SIMATIC Drive Controller CPU 1507D TF	affected 0 < *
Siemens · SIMATIC ET 200SP CPU 1510SP F-1 PN	affected 0 < *
Siemens · SIMATIC ET 200SP CPU 1510SP F-1 PN	affected 0 < *
Siemens · SIMATIC ET 200SP CPU 1510SP-1 PN	affected 0 < *
Siemens · SIMATIC ET 200SP CPU 1510SP-1 PN	affected 0 < *
Siemens · SIMATIC ET 200SP CPU 1512SP F-1 PN	affected 0 < *
Siemens · SIMATIC ET 200SP CPU 1512SP F-1 PN	affected 0 < *
Siemens · SIMATIC ET 200SP CPU 1512SP-1 PN	affected 0 < *
Siemens · SIMATIC ET 200SP CPU 1512SP-1 PN	affected 0 < *
Siemens · SIMATIC ET 200SP CPU 1514SP F-2 PN	affected 0 < *
Siemens · SIMATIC ET 200SP CPU 1514SP-2 PN	affected 0 < *
Siemens · SIMATIC ET 200SP CPU 1514SPT F-2 PN	affected 0 < *
Siemens · SIMATIC ET 200SP CPU 1514SPT-2 PN	affected 0 < *
Siemens · SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)	affected 0 < *
Siemens · SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V2 CPUs - Windows OS	affected 0 < *
Siemens · SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Industrial OS	affected 0 < *
Siemens · SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Windows OS	affected 0 < *
Siemens · SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 CPUs	affected 0 < *
Siemens · SIMATIC S7-1500 CPU 1511-1 PN	affected 0 < *

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

🟡 Siemens SIMATIC Drive Controller CPU 1504D TF