CVE-2026-25789

published 2026-05-12

CVE-2026-25789: Affected devices do not properly validate and sanitize filenames on the Firmware Update page. This could allow a remote attacker to social engineer the user…

Priority P3 38 high 7.1 CVSS 3.1

AV N AC H PR L UI R S U C H I H A H

Affected devices do not properly validate and sanitize filenames on the Firmware Update page. This could allow a remote attacker to social engineer the user into selecting the modified firmware file to be uploaded. This would result in malitcious JavaScript execution in the context of the authenticated user's session without requiring the file to be uploaded, potentially leading to session hijacking or credential theft.

Affected

139 ranges · showing 25

Vendor	Product	Version range	Fixed in
siemens	simatic_drive_controller_cpu_1504d_tf	< V3.1.6	V3.1.6
siemens	simatic_drive_controller_cpu_1507d_tf	< V3.1.6	V3.1.6
siemens	simatic_et_200sp_cpu_1510sp-1_pn	< *	*
siemens	simatic_et_200sp_cpu_1510sp-1_pn	< V2.9.9	V2.9.9
siemens	simatic_et_200sp_cpu_1510sp-1_pn	< V4.1.6	V4.1.6
siemens	simatic_et_200sp_cpu_1510sp_f-1_pn	< *	*
siemens	simatic_et_200sp_cpu_1510sp_f-1_pn	< V2.9.9	V2.9.9
siemens	simatic_et_200sp_cpu_1510sp_f-1_pn	< V4.1.6	V4.1.6
siemens	simatic_et_200sp_cpu_1512sp-1_pn	< *	*
siemens	simatic_et_200sp_cpu_1512sp-1_pn	< V2.9.9	V2.9.9
siemens	simatic_et_200sp_cpu_1512sp-1_pn	< V4.1.6	V4.1.6
siemens	simatic_et_200sp_cpu_1512sp_f-1_pn	< *	*
siemens	simatic_et_200sp_cpu_1512sp_f-1_pn	< V2.9.9	V2.9.9
siemens	simatic_et_200sp_cpu_1512sp_f-1_pn	< V4.1.6	V4.1.6
siemens	simatic_et_200sp_cpu_1514sp-2_pn	< V4.1.6	V4.1.6
siemens	simatic_et_200sp_cpu_1514sp_f-2_pn	< V4.1.6	V4.1.6
siemens	simatic_et_200sp_cpu_1514spt-2_pn	< V4.1.6	V4.1.6
siemens	simatic_et_200sp_cpu_1514spt_f-2_pn	< V4.1.6	V4.1.6
siemens	simatic_et_200sp_open_controller_cpu_1515sp_pc	< *	*
siemens	simatic_et_200sp_open_controller_cpu_1515sp_pc2_v2_cpus	< *	*
siemens	simatic_et_200sp_open_controller_cpu_1515sp_pc2_v3_cpus	< *	*
siemens	simatic_et_200sp_open_controller_cpu_1515sp_pc3_v4_cpus	< *	*
siemens	simatic_s7-1500_cpu_1511-1_pn	< *	*
siemens	simatic_s7-1500_cpu_1511-1_pn	< V2.9.9	V2.9.9
siemens	simatic_s7-1500_cpu_1511-1_pn	< V4.1.6	V4.1.6

CVSS provenance

nvd v3.1 7.1 HIGH CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

nvd v4.0 7.2 HIGH CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79