CVE-2026-25789 is a cross-site scripting vulnerability (CWE-79) in Siemens SIMATIC Drive Controller CPU 1504D TF. The issue arises from insufficient validation and sanitization of filenames on the Firmware Update page, allowing an attacker to craft filenames containing malicious JavaScript. When an authenticated user interacts with the modified filename, the script executes in their session context without needing the file to be uploaded. This can lead to session hijacking or credential theft. The vulnerability has a CVSS 3.1 base score of 7.1 (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H). There is no vendor advisory or patch information available at this time.

Successful exploitation can result in execution of arbitrary JavaScript in the context of an authenticated user's session, potentially leading to session hijacking and credential theft. The vulnerability requires user interaction (UI:R) and low privileges (PR:L) but can have high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with firmware update filenames and avoid selecting files from untrusted sources. Monitor Siemens advisories for updates.