CVE-2026-25786 is a cross-site scripting (CWE-79) vulnerability in Siemens SIMATIC Drive Controller CPU 1504D TF. The issue arises because the device does not properly validate or sanitize the PLC/station name rendered on the communication parameters page of its web interface. An authenticated attacker authorized to download TIA projects can inject malicious scripts into this field. When a legitimate user with appropriate rights views the page, the malicious script executes in their browser session, potentially compromising confidentiality, integrity, and availability of the device or session. The vulnerability is rated critical with a CVSS 3.1 base score of 9.1, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with high privileges to inject malicious scripts into the web interface, which execute in the context of other authorized users' sessions. This can lead to full compromise of confidentiality, integrity, and availability of the affected device or session. The vulnerability affects the web management interface and can be leveraged to perform unauthorized actions or steal sensitive information from legitimate users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the web interface to trusted users only and limit the number of users authorized to download TIA projects. Monitor Siemens advisories for updates on official patches or mitigations.