High severity · published May 12, 2026
CVE-2026-25789
Affected devices do not properly validate and sanitize filenames on the Firmware Update page
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
Affected devices do not properly validate and sanitize filenames on the Firmware Update page. This could allow a remote attacker to social engineer the user into selecting the modified firmware file to be uploaded. This would result in malitcious JavaScript execution in the context of the authenticated user's session without requiring the file to be uploaded, potentially leading to session hijacking or credential theft.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
SIMATIC Drive Controller CPU 1504D TF · Siemens
before V3.1.6 · source: vendor
SD
SIMATIC Drive Controller CPU 1507D TF · Siemens
before V3.1.6 · source: vendor
SE
SIMATIC ET 200SP CPU 1510SP F-1 PN · Siemens
0; before V2.9.9; before V4.1.6 · source: vendor
SE
SIMATIC ET 200SP CPU 1510SP-1 PN · Siemens
0; before V2.9.9; before V4.1.6 · source: vendor
SE
SIMATIC ET 200SP CPU 1512SP F-1 PN · Siemens
0; before V2.9.9; before V4.1.6 · source: vendor
SE
SIMATIC ET 200SP CPU 1512SP-1 PN · Siemens
0; before V2.9.9; before V4.1.6 · source: vendor
SE
SIMATIC ET 200SP CPU 1514SP F-2 PN · Siemens
before V4.1.6 · source: vendor
SE
SIMATIC ET 200SP CPU 1514SP-2 PN · Siemens
before V4.1.6 · source: vendor
SE
SIMATIC ET 200SP CPU 1514SPT F-2 PN · Siemens
before V4.1.6 · source: vendor
SE
SIMATIC ET 200SP CPU 1514SPT-2 PN · Siemens
before V4.1.6 · source: vendor
SE
Affected product
SD
SIMATIC Drive Controller CPU 1504D TF
Siemens
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25789
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25789
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-688146.html
More from SIMATIC Drive Controller CPU 1504D TF
9.6
CVE-2026-63354
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page
9.6
CVE-2026-63353
Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page
9.6
CVE-2026-63350
Affected devices do not properly restrict executable content contained in imported trace files
9.1
CVE-2026-25787
Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface
9.1
CVE-2026-25786
Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface