CVE-2026-85114 is a path traversal vulnerability in Siemens .NET Client Library for SIMATIC S7 Webserver API versions prior to 3.3.61. The affected library does not properly validate filenames received from remote servers during ticket downloads, allowing an attacker who can manipulate the ticket response to write arbitrary files outside the intended directory. This can lead to overwriting existing files accessible to the application if overwriting is enabled.
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine
CVE-2026-78556 is a vulnerability in Siemens Industrial Edge App Publisher versions prior to 1.27.9. The software fails to properly validate server certificates during TLS connections, enabling potential Man-in-the-Middle (MitM) attacks where an attacker can intercept or spoof communications. This flaw affects all versions from 0 up to but not including 1.27.9. The vulnerability has a high severity rating with a CVSS score of 7.4.
A vulnerability in Siemens SIMATIC IPC BX-21A and related models allows bypassing UEFI Secure Boot protections due to the presence of a BIOS vendor test key in the UEFI Secure Boot key database. This affects all versions prior to V31.01.13 for IPC BX-21A, prior to V1.1.4 for IPC RW-543A, and prior to V28.01.15 for IPC227G, IPC277G, IPC277G PRO, IPC327G, and IPC377G. An attacker with local physical or administrative access could exploit this to boot unauthorized operating systems or UEFI applications, potentially compromising device confidentiality, integrity, and availability.
Siemens SIMATIC Drive Controller CPU 1504D TF devices have a cross-site scripting (XSS) vulnerability due to improper sanitization of calculated signal data in imported files. An attacker can craft a malicious file that, when imported by an authorized user with 'Read diagnostics' rights, executes attacker-controlled JavaScript in the user's browser. This could allow the attacker to perform PLC operations within the user's authorization scope. The vulnerability has a CVSS score of 6.1 (medium severity).
Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user’s browser session when the resulting error message is displayed.
Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user’s browser session when the user subsequently interacts with an affected selection menu.
CVE-2026-63354 is a critical cross-site scripting (XSS) vulnerability in Siemens SIMATIC Drive Controller CPU 1504D TF. The issue arises because the device does not properly validate or sanitize visual marker data in imported CSV trace files before displaying it on the Trace page. An attacker could trick an authorized user with the “Read diagnostics” permission into importing a maliciously crafted trace file. This could lead to execution of attacker-controlled JavaScript in the user's browser session, potentially allowing unauthorized PLC operations within the user's authorization scope.
Siemens SIMATIC Drive Controller CPU 1504D TF devices have a cross-site scripting (XSS) vulnerability due to improper sanitization of comment fields in imported trace files. An attacker can craft a malicious trace file that, when imported by an authorized user with 'Read diagnostics' rights, executes attacker-controlled JavaScript in the user's browser. This can lead to unauthorized PLC operations within the user's authorization scope. The vulnerability has a critical severity with a CVSS score of 9.6.
Siemens SIMATIC Drive Controller CPU 1504D TF devices improperly sanitize calculated signal data from imported CSV trace files before rendering on the Trace page. This vulnerability allows an attacker to craft a malicious trace file that, when imported by an authorized user with 'Read diagnostics' rights, can execute attacker-controlled JavaScript in the user's browser session. The script could perform PLC operations within the user's authorization scope. The CVSS score is 6.1, indicating a medium severity vulnerability.
Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
Affected devices do not properly restrict executable content contained in imported trace files.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
CVE-2026-59241 is a high-severity vulnerability in Siemens SIMATIC WinCC versions 7.5, 8.0 (prior to Update 11), and 8.1 (prior to Update 7). It involves incorrect privilege assignment to a database role, allowing an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system. This could lead to full system compromise.
CVE-2026-44415 is a critical path traversal vulnerability in Siemens Industrial Edge Device Kit - arm64 V1.10. Authenticated users can exploit improper restrictions on internal APIs and paths to access sensitive internal information. This can lead to unauthorized system access or data deletion.
CVE-2026-44414 is a path traversal vulnerability in Siemens Industrial Edge Cloud Device (IECD) and related Industrial Edge Device Kit versions. Authenticated remote attackers can exploit improper access restrictions to internal APIs and paths, potentially accessing sensitive internal information. The vulnerability affects multiple versions of the Industrial Edge Device Kit for both arm64 and x86-64 architectures, as well as various Siemens Industrial Edge devices. The CVSS 3.1 score is 6.8 (medium severity), indicating a significant confidentiality impact but no integrity or availability impact. No official patch or remediation details are provided in the available data.
A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions < V3.94), WTV776-HB6035 Web Interface (All versions < V4.17). Affected devices do not properly validate input received from backend services.
This could allow an unauthenticated remote attacker to force the device into protection mode, which results in losing remote connectivity functions (Web Access).
CVE-2026-67367 is a high-severity vulnerability affecting multiple versions of Siemens SIMOVE Fleetmanager and SIPLANT products. The flaw is a relative path traversal in the embedded HTTP server's file-serving endpoint, allowing unauthenticated remote attackers to read arbitrary files on the underlying operating system. This can expose sensitive information such as credential stores, private keys, and configuration secrets. The vulnerability affects all versions prior to specific fixed releases in SIMOVE Fleetmanager V3.1, V3.2, V3.3, V4.0, and SIPLANT V3.1, as well as all versions of SIPLANT V1.7, V2.2, and V3.0. No known exploits in the wild have been reported, and no patch links were provided in the source data.
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special maintenance mode can be activated via a physical key sequence during device boot, in which the device downloads and executes program code from a network server without verifying its authenticity or integrity. This could allow an attacker with physical access to the device to upload and execute arbitrary, unsigned code.
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The input received over a proprietary communication protocol that is exposed when the device is placed into a special firmware-update mode is not properly validated, resulting in a memory corruption condition. This could allow an unauthenticated attacker with physical access to the device to cause a crash and potentially execute arbitrary code on the device.
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The device firmware contains binaries from which debugging symbols have not been removed. This could allow an unauthenticated attacker with access to the publicly available firmware update files to more easily reverse engineer the device's firmware, facilitating the identification of further vulnerabilities.