This vulnerability (CVE-2026-25789) involves improper neutralization of input during web page generation (CWE-79) in Siemens SIMATIC Drive Controller CPU 1504D TF. Specifically, the Firmware Update page fails to properly validate and sanitize filenames, allowing an attacker to embed malicious JavaScript code in the filename. When a user is socially engineered into selecting such a file, the script executes within the user's authenticated session context, potentially compromising session integrity and credentials. The CVSS 3.1 base score is 7.1, indicating high severity with network attack vector, high attack complexity, low privileges required, and user interaction needed.

Successful exploitation can lead to execution of arbitrary JavaScript code in the context of an authenticated user's session. This can result in session hijacking or theft of user credentials, compromising the security of the affected device and potentially the broader control environment it manages. The vulnerability does not require the firmware file to be uploaded, only that the user selects the malicious file name, making social engineering the primary attack vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround has been published by Siemens, users should exercise caution when interacting with firmware update files and avoid selecting files from untrusted sources. Monitor Siemens advisories for updates on patches or mitigations.