CVE-2026-25787

N/A

Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page. If a benign user with appropriate rights accesses the "Motion Control Diagnostics" parameters page, the malicious code would be executed in the scope of their web session.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Siemens SIMATIC 跨站脚本漏洞

Siemens SIMATIC是德国西门子（Siemens）公司的一系列面向工业自动化与过程控制场景的可编程控制与工业软件产品。 Siemens SIMATIC存在跨站脚本漏洞，该漏洞源于Web界面运动控制诊断页面未正确验证和清理技术对象名称，可能导致经过身份验证的攻击者注入恶意脚本，当具有适当权限的用户访问该页面时，恶意代码将在其Web会话中执行。以下产品受到影响：SIMATIC Drive Controller CPU 1504D TF、SIMATIC Drive Controller CPU 150

N/A

N/A