GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CNVD-2026-13386

Vulnerability from cnvd - Published: 2026-03-12
VLAI
Title
Siemens SIMATIC S7-1500设备存储型跨站脚本漏洞
Description
SIMATIC S7-1500是西门子公司推出的工业控制器。 Siemens SIMATIC S7-1500存在存储型跨站脚本漏洞,攻击者可利用漏洞通过诱使合法用户在网页界面中导入特制的跟踪文件来注入代码。
Severity
Formal description

厂商已为若干受影响产品发布了新版本,并建议更新到最新版本,对尚未提供修复的产品,请关注厂商主页更新: https://cert-portal.siemens.com/productcert/html/ssa-452276.html

Impacted products
Name
['Siemens SIMATIC S7-1500 Software Controller', 'Siemens SIMATIC S7-PLCSIM Advanced', 'Siemens SIMATIC Drive Controller family', 'Siemens SIMATIC ET 200SP Open Controller (incl. SIPLUS variants)', 'Siemens SIMATIC S7-1500 CPU family (incl. related ET 200 CPUs and SIPLUS variants)']
Show details on source website

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2025-40943"
    }
  },
  "description": "SIMATIC S7-1500\u662f\u897f\u95e8\u5b50\u516c\u53f8\u63a8\u51fa\u7684\u5de5\u4e1a\u63a7\u5236\u5668\u3002\n\nSiemens SIMATIC S7-1500\u5b58\u5728\u5b58\u50a8\u578b\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u901a\u8fc7\u8bf1\u4f7f\u5408\u6cd5\u7528\u6237\u5728\u7f51\u9875\u754c\u9762\u4e2d\u5bfc\u5165\u7279\u5236\u7684\u8ddf\u8e2a\u6587\u4ef6\u6765\u6ce8\u5165\u4ee3\u7801\u3002",
  "formalWay": "\u5382\u5546\u5df2\u4e3a\u82e5\u5e72\u53d7\u5f71\u54cd\u4ea7\u54c1\u53d1\u5e03\u4e86\u65b0\u7248\u672c\uff0c\u5e76\u5efa\u8bae\u66f4\u65b0\u5230\u6700\u65b0\u7248\u672c\uff0c\u5bf9\u5c1a\u672a\u63d0\u4f9b\u4fee\u590d\u7684\u4ea7\u54c1\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttps://cert-portal.siemens.com/productcert/html/ssa-452276.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2026-13386",
  "openTime": "2026-03-12",
  "products": {
    "product": [
      "Siemens SIMATIC S7-1500 Software Controller",
      "Siemens SIMATIC S7-PLCSIM Advanced",
      "Siemens SIMATIC Drive Controller family",
      "Siemens SIMATIC ET 200SP Open Controller (incl. SIPLUS variants)",
      "Siemens SIMATIC S7-1500 CPU family (incl. related ET 200 CPUs and SIPLUS variants)"
    ]
  },
  "serverity": "\u9ad8",
  "submitTime": "2026-03-10",
  "title": "Siemens SIMATIC S7-1500\u8bbe\u5907\u5b58\u50a8\u578b\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.


Loading…