Critical severity · published Mar 10, 2026
CVE-2025-40943
Affected devices do not properly sanitize contents of trace files
9.6
CVSS
0.5%
EPSS
No
On KEV
Description
Affected devices do not properly sanitize contents of trace files.
This could allow an attacker to inject code through social engineering an authorized user, who has the function right "Read diagnostics", to import a specially crafted trace file.
The malicious trace file is insufficiently sanitized and malicious code could be executed in the clients browser session and trigger PLC operations via the webserver that the legitimate user is authorized to perform.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
SIMATIC Drive Controller CPU 1504D TF · Siemens
before V3.1.6 · source: vendor
SD
SIMATIC Drive Controller CPU 1507D TF · Siemens
before V3.1.6 · source: vendor
SE
SIMATIC ET 200SP CPU 1510SP F-1 PN · Siemens
before V2.9.9; before V4.1.2 · source: vendor
SE
SIMATIC ET 200SP CPU 1510SP-1 PN · Siemens
before V2.9.9; before V4.1.2 · source: vendor
SE
SIMATIC ET 200SP CPU 1512SP F-1 PN · Siemens
before V2.9.9; before V4.1.2 · source: vendor
SE
SIMATIC ET 200SP CPU 1512SP-1 PN · Siemens
before V2.9.9; before V4.1.2 · source: vendor
SE
SIMATIC ET 200SP CPU 1514SP F-2 PN · Siemens
before V4.1.2 · source: vendor
SE
SIMATIC ET 200SP CPU 1514SP-2 PN · Siemens
before V4.1.2 · source: vendor
SE
SIMATIC ET 200SP CPU 1514SPT F-2 PN · Siemens
before V4.1.2 · source: vendor
SE
SIMATIC ET 200SP CPU 1514SPT-2 PN · Siemens
before V4.1.2 · source: vendor
SE
In the news
VulnerabilityHigh
Siemens SIMATIC
View CSAF
Summary
SIMATIC S7-1500 devices contain a vulnerability that could allow an attacker to inject code by tricking a legitimate user into importing a specially crafted trace file in the web interface. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
The following versions of Siemens SIMATIC are affected:
SIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0) vers:all/* (CVE-2025-40943)
SIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0) vers:all/* (CVE-2025-40943)
SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0) vers:all/* (CVE-2025-40943)
SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SK03-0AB0) vers:intdot/<4.1.2 (CVE-2025-40943)
SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DJ01-0AB0) vers:all/* (CVE-2025-40943)
SIMATIC ET 200SP CPU 1510SP-1 PN (6ES7510-1DK03-0AB0) vers:intdot/<4.1.2 (CVE-2025-40943)
SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SK01-0AB0) vers:all/* (CVE-2025-40943)
SIMATIC ET 200SP CPU 1512SP F-1 PN (6ES7512-1SM03-0AB0) vers:intdot/<4.1.2 (CVE-2025-40943)
SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DK01-0AB0) vers:all/* (CVE-2025-40943)
SIMATIC ET 200SP CPU 1512SP-1 PN (6ES7512-1DM03-0AB0) vers:intdot/<4.1.2 (CVE-2025-40943)
SIMATIC ET 200SP CPU 1514SP F-2 PN (6ES7514-2SN03-0AB0) vers:intdot/&...
Mar 12, 2026·CISA Advisories
Affected product
SD
SIMATIC Drive Controller CPU 1504D TF
Siemens
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-40943
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-40943
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-452276.html
More from SIMATIC Drive Controller CPU 1504D TF
9.6
CVE-2026-63354
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page
9.6
CVE-2026-63353
Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page
9.6
CVE-2026-63350
Affected devices do not properly restrict executable content contained in imported trace files
9.1
CVE-2026-25787
Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface
9.1
CVE-2026-25786
Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface