Siemens SIMATIC CPUs face critical web server code execution flaw
A critical vulnerability in Siemens industrial controllers allows attackers to run malicious scripts via crafted trace files.
Key points
- CVE-2026-63350 carries a CVSS score of 9.6, rated as critical severity by the National Vulnerability Database.
- The flaw affects multiple Siemens SIMATIC Drive Controller and ET 200SP CPU models that process imported trace files.
- Exploitation requires social engineering a user with "Read diagnostics" rights to open a malicious file in their browser.
Siemens industrial control systems contain a critical vulnerability that permits unauthorized code execution through manipulated trace files. The National Vulnerability Database records this flaw as CVE-2026-63350, assigning it a CVSS score of 9.6. This high-severity rating reflects the potential for an attacker to compromise the web server interface of affected programmable logic controllers.
At a glance
- CVE
- CVE-2026-63350
- Product
- Siemens SIMATIC Drive Controller CPU 1504D TF
- CVSS
- 9.6 Critical
- Weakness
- CWE-95
- Exploited
- No known exploitation
The vulnerability stems from insufficient restrictions on executable content within imported trace files. According to the NVD record, the weakness is classified under CWE-95, indicating improper neutralization of eval expressions. An attacker can craft a trace file containing malicious JavaScript. If an authorized user imports this file, the script executes within their browser session.
Context and Background
Successful exploitation relies on social engineering rather than direct network intrusion. The attacker must convince a user who holds the specific function right “Read diagnostics” to import the specially crafted trace file. Once the user opens the file, the embedded JavaScript runs in the context of their browser session. This allows the attacker to perform PLC operations through the web server, limited only by the scope of the user’s existing authorization.
The National Vulnerability Database describes the issue as a failure to properly restrict executable content. This means the web server interface processes the JavaScript included in the trace file without adequate validation. That suggests the primary defense lies in preventing users from importing untrusted diagnostic data into the system interface.
Who Is Affected
Several Siemens hardware models are listed as affected by this vulnerability. The NVD record identifies specific versions of the SIMATIC Drive Controller and ET 200SP series. The affected devices include the SIMATIC Drive Controller CPU 1504D TF and the SIMATIC Drive Controller CPU 1507D TF. Both are listed as affected in versions prior to an unspecified update.
The ET 200SP series also faces exposure. The record lists the SIMATIC ET 200SP CPU 1510SP F-1 PN and the SIMATIC ET 200SP CPU 1510SP-1 PN. These entries appear twice in the source material, likely reflecting duplicate records or variant naming conventions. All listed models are affected in versions before the next release, though no specific patch version is named in the current data.
No confirmed fix or software update has been announced for these devices in the provided source material. Security teams should assume that current versions of these controllers remain vulnerable until Siemens releases a verified patch. The lack of a confirmed remedy increases the risk for organizations relying on these specific hardware models for industrial automation tasks.
What should you do?
Organizations using these Siemens controllers should immediately audit access rights for the “Read diagnostics” function. Limiting this permission to only essential personnel reduces the pool of potential targets for social engineering attacks. Security teams should also monitor web server logs for unusual JavaScript execution or unauthorized PLC commands initiated through the browser interface.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: Siemens
- Restrict the “Read diagnostics” function right to a minimal number of trusted administrators to reduce social engineering targets.
- Monitor web server logs for unexpected JavaScript execution or PLC operations originating from user browser sessions.
- Validate the integrity of all trace files before importing them into the controller’s web interface.
- Isolate affected controllers from networks where untrusted users may access the web server until a vendor patch is available.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-63350?
The National Vulnerability Database rates CVE-2026-63350 with a CVSS score of 9.6, classifying it as critical.
Which Siemens devices are affected by this vulnerability?
Affected devices include SIMATIC Drive Controller CPU 1504D TF, CPU 1507D TF, and several ET 200SP CPU 1510SP models.
How is this vulnerability exploited?
An attacker social engineers a user with “Read diagnostics” rights to import a malicious trace file, executing JavaScript in their browser.
