CVE-2026-25787
published 2026-05-12CVE-2026-25787: Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface. This…
PriorityP355critical9.1CVSS 3.1
AVNACLPRHUINSCCHIHAH
EPSS
0.37%
29.6th percentile
Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page.
If a benign user with appropriate rights accesses the "Motion Control Diagnostics" parameters page, the malicious code would be executed in the scope of their web session.
Affected
139 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | simatic_drive_controller_cpu_1504d_tf | < V3.1.6 | V3.1.6 |
| siemens | simatic_drive_controller_cpu_1507d_tf | < V3.1.6 | V3.1.6 |
| siemens | simatic_et_200sp_cpu_1510sp-1_pn | < * | * |
| siemens | simatic_et_200sp_cpu_1510sp-1_pn | < V2.9.9 | V2.9.9 |
| siemens | simatic_et_200sp_cpu_1510sp-1_pn | < V4.1.6 | V4.1.6 |
| siemens | simatic_et_200sp_cpu_1510sp_f-1_pn | < * | * |
| siemens | simatic_et_200sp_cpu_1510sp_f-1_pn | < V2.9.9 | V2.9.9 |
| siemens | simatic_et_200sp_cpu_1510sp_f-1_pn | < V4.1.6 | V4.1.6 |
| siemens | simatic_et_200sp_cpu_1512sp-1_pn | < * | * |
| siemens | simatic_et_200sp_cpu_1512sp-1_pn | < V2.9.9 | V2.9.9 |
| siemens | simatic_et_200sp_cpu_1512sp-1_pn | < V4.1.6 | V4.1.6 |
| siemens | simatic_et_200sp_cpu_1512sp_f-1_pn | < * | * |
| siemens | simatic_et_200sp_cpu_1512sp_f-1_pn | < V2.9.9 | V2.9.9 |
| siemens | simatic_et_200sp_cpu_1512sp_f-1_pn | < V4.1.6 | V4.1.6 |
| siemens | simatic_et_200sp_cpu_1514sp-2_pn | < V4.1.6 | V4.1.6 |
| siemens | simatic_et_200sp_cpu_1514sp_f-2_pn | < V4.1.6 | V4.1.6 |
| siemens | simatic_et_200sp_cpu_1514spt-2_pn | < V4.1.6 | V4.1.6 |
| siemens | simatic_et_200sp_cpu_1514spt_f-2_pn | < V4.1.6 | V4.1.6 |
| siemens | simatic_et_200sp_open_controller_cpu_1515sp_pc | < * | * |
| siemens | simatic_et_200sp_open_controller_cpu_1515sp_pc2_v2_cpus | < * | * |
| siemens | simatic_et_200sp_open_controller_cpu_1515sp_pc2_v3_cpus | < * | * |
| siemens | simatic_et_200sp_open_controller_cpu_1515sp_pc3_v4_cpus | < * | * |
| siemens | simatic_s7-1500_cpu_1511-1_pn | < * | * |
| siemens | simatic_s7-1500_cpu_1511-1_pn | < V2.9.9 | V2.9.9 |
| siemens | simatic_s7-1500_cpu_1511-1_pn | < V4.1.6 | V4.1.6 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-12
Published