Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface.
This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page.
If a benign user with appropriate rights accesses the "communication" parameters page, the malicious code would be executed in the scope of their web session.
Metrics
Affected Vendors & Products
References
History
Tue, 12 May 2026 13:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 12 May 2026 09:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page. If a benign user with appropriate rights accesses the "communication" parameters page, the malicious code would be executed in the scope of their web session. | |
| Weaknesses | CWE-79 | |
| References |
| |
| Metrics |
cvssV3_1
|
Status: PUBLISHED
Assigner: siemens
Published:
Updated: 2026-05-12T12:42:40.239Z
Reserved: 2026-02-05T19:53:27.491Z
Link: CVE-2026-25786
Updated: 2026-05-12T12:42:36.956Z
Status : Received
Published: 2026-05-12T10:16:44.193
Modified: 2026-05-12T10:16:44.193
Link: CVE-2026-25786
No data.
OpenCVE Enrichment
Updated: 2026-05-12T10:30:13Z