cbcvebase.
CVE-2026-25787
published 2026-05-12

CVE-2026-25787: Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface. This…

PriorityP355critical9.1CVSS 3.1
AVNACLPRHUINSCCHIHAH
EPSS
0.37%
29.6th percentile
Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page. If a benign user with appropriate rights accesses the "Motion Control Diagnostics" parameters page, the malicious code would be executed in the scope of their web session.

Affected

139 ranges· showing 25
VendorProductVersion rangeFixed in
siemenssimatic_drive_controller_cpu_1504d_tf< V3.1.6V3.1.6
siemenssimatic_drive_controller_cpu_1507d_tf< V3.1.6V3.1.6
siemenssimatic_et_200sp_cpu_1510sp-1_pn< **
siemenssimatic_et_200sp_cpu_1510sp-1_pn< V2.9.9V2.9.9
siemenssimatic_et_200sp_cpu_1510sp-1_pn< V4.1.6V4.1.6
siemenssimatic_et_200sp_cpu_1510sp_f-1_pn< **
siemenssimatic_et_200sp_cpu_1510sp_f-1_pn< V2.9.9V2.9.9
siemenssimatic_et_200sp_cpu_1510sp_f-1_pn< V4.1.6V4.1.6
siemenssimatic_et_200sp_cpu_1512sp-1_pn< **
siemenssimatic_et_200sp_cpu_1512sp-1_pn< V2.9.9V2.9.9
siemenssimatic_et_200sp_cpu_1512sp-1_pn< V4.1.6V4.1.6
siemenssimatic_et_200sp_cpu_1512sp_f-1_pn< **
siemenssimatic_et_200sp_cpu_1512sp_f-1_pn< V2.9.9V2.9.9
siemenssimatic_et_200sp_cpu_1512sp_f-1_pn< V4.1.6V4.1.6
siemenssimatic_et_200sp_cpu_1514sp-2_pn< V4.1.6V4.1.6
siemenssimatic_et_200sp_cpu_1514sp_f-2_pn< V4.1.6V4.1.6
siemenssimatic_et_200sp_cpu_1514spt-2_pn< V4.1.6V4.1.6
siemenssimatic_et_200sp_cpu_1514spt_f-2_pn< V4.1.6V4.1.6
siemenssimatic_et_200sp_open_controller_cpu_1515sp_pc< **
siemenssimatic_et_200sp_open_controller_cpu_1515sp_pc2_v2_cpus< **
siemenssimatic_et_200sp_open_controller_cpu_1515sp_pc2_v3_cpus< **
siemenssimatic_et_200sp_open_controller_cpu_1515sp_pc3_v4_cpus< **
siemenssimatic_s7-1500_cpu_1511-1_pn< **
siemenssimatic_s7-1500_cpu_1511-1_pn< V2.9.9V2.9.9
siemenssimatic_s7-1500_cpu_1511-1_pn< V4.1.6V4.1.6

CVSS provenance

nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.