Siemens — CraftedSignal Threat Feed

Siemens SIMATIC S7 PLCs Web Server Vulnerabilities Allow Cross-Site Scripting

hello@craftedsignal.io — Tue, 12 May 2026 11:44:35 +0000

Multiple cross-site scripting (XSS) vulnerabilities have been identified in the web server component of Siemens SIMATIC S7 PLCs. An authenticated, remote attacker could exploit these vulnerabilities by injecting malicious scripts into the web application. Successful exploitation could lead to the execution of arbitrary code in the context of the victim’s browser, potentially allowing the attacker to steal sensitive information, modify web page content, or perform actions on behalf of the user. The vulnerabilities affect Siemens SIMATIC S7 PLCs Web Server. This issue highlights the importance of proper input validation and output encoding within web-based management interfaces for industrial control systems.

Attack Chain

The attacker authenticates to the SIMATIC S7 PLC’s web server using valid credentials.
The attacker identifies an input field vulnerable to XSS (e.g., a configuration parameter or log message field).
The attacker crafts a malicious payload containing JavaScript code.
The attacker injects the payload into the vulnerable input field via a crafted HTTP request.
The PLC’s web server stores the malicious payload.
A legitimate user accesses the web page containing the injected payload.
The user’s browser executes the malicious JavaScript code, potentially granting the attacker access to sensitive information or the ability to perform actions on behalf of the user.
The attacker leverages the XSS vulnerability to further compromise the PLC or the network it resides on.

Impact

Successful exploitation of these XSS vulnerabilities could allow an attacker to steal user credentials, modify PLC configurations, or launch further attacks against the industrial control system network. The number of affected devices and the specific impact depends on the configuration and role of the affected SIMATIC S7 PLCs within the industrial environment. If successful, this could lead to disruption of critical infrastructure or industrial processes.

Recommendation

Deploy the Sigma rule below to detect potential XSS attempts against the SIMATIC S7 PLCs Web Server.
Implement proper input validation and output encoding within the SIMATIC S7 PLCs Web Server application.
Apply the latest security patches and updates provided by Siemens for SIMATIC S7 PLCs Web Server when available.
Regularly review and audit the security configurations of SIMATIC S7 PLCs to minimize the attack surface.

Siemens SIPROTEC 5 Information Disclosure Vulnerability

hello@craftedsignal.io — Tue, 12 May 2026 11:35:41 +0000

A vulnerability exists within Siemens SIPROTEC 5 devices that allows for information disclosure. The specific nature of the vulnerability is not detailed in this brief, but it can be exploited by a remote, anonymous attacker. Siemens SIPROTEC 5 devices are used in a variety of industrial control systems (ICS) and critical infrastructure settings. Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive configuration data, device status information, or other proprietary information. This information could then be used for further malicious activities, such as launching targeted attacks or disrupting operations. Defenders should promptly investigate and mitigate this vulnerability to reduce the risk of exploitation.

Attack Chain

The attacker identifies a Siemens SIPROTEC 5 device accessible over the network.
The attacker crafts a malicious request to exploit the information disclosure vulnerability.
The device processes the request and inadvertently discloses sensitive information.
The attacker captures the disclosed information, which may include configuration settings, device status, or other proprietary data.
The attacker analyzes the disclosed information to identify potential weaknesses or vulnerabilities in the system.
The attacker uses the gathered information to plan further attacks, such as disrupting device operation or compromising the wider ICS network.

Impact

Successful exploitation of this vulnerability could result in unauthorized access to sensitive information stored on Siemens SIPROTEC 5 devices. This could potentially affect critical infrastructure, leading to operational disruptions and/or financial losses. While the number of victims and specific sectors targeted are unknown, any organization using affected Siemens SIPROTEC 5 devices is potentially at risk.

Recommendation

Investigate network traffic to Siemens SIPROTEC 5 devices for anomalous activity (see Sigma rule below).
Consult Siemens’ security advisories and apply any available patches or mitigations for SIPROTEC 5 devices.
Implement network segmentation and access controls to limit exposure of SIPROTEC 5 devices to untrusted networks.
Monitor device logs for any signs of unauthorized access or suspicious behavior.

Solid Edge SE2026 Stack-Based Overflow Vulnerability (CVE-2026-44412)

hello@craftedsignal.io — Tue, 12 May 2026 10:21:33 +0000

A stack-based buffer overflow vulnerability, tracked as CVE-2026-44412, has been identified in Siemens Solid Edge SE2026. The vulnerability exists in all versions prior to V226.0 Update 5. This flaw stems from improper handling of specially crafted PAR files, potentially enabling an attacker to execute arbitrary code within the context of the affected process. Successful exploitation could lead to complete system compromise, data theft, or other malicious activities. Siemens has released an update to address this vulnerability. This vulnerability poses a significant risk to organizations utilizing affected versions of Solid Edge SE2026 for CAD and engineering design.

Attack Chain

An attacker crafts a malicious PAR file specifically designed to trigger the stack-based buffer overflow.
The attacker delivers the malicious PAR file to a target user, potentially through social engineering, email attachment, or a compromised website.
The user opens the malicious PAR file using a vulnerable version of Solid Edge SE2026.
Solid Edge SE2026 attempts to parse the PAR file.
During the parsing process, the specially crafted data overflows the designated buffer on the stack.
The overflow overwrites critical data, including the return address, on the stack.
Upon function return, control is redirected to an attacker-controlled address.
The attacker executes arbitrary code within the context of the Solid Edge SE2026 process, potentially gaining complete control over the system.

Impact

Successful exploitation of CVE-2026-44412 allows an attacker to execute arbitrary code on the targeted system. This can lead to a variety of detrimental outcomes, including data theft, system compromise, and the installation of malware. Given the use of Solid Edge SE2026 in industrial design and engineering, successful attacks could disrupt critical infrastructure, compromise sensitive intellectual property, and cause significant financial losses. The number of potential victims is substantial, encompassing all organizations utilizing vulnerable versions of Solid Edge SE2026.

Recommendation

Immediately update Solid Edge SE2026 to V226.0 Update 5 or later to patch CVE-2026-44412.
Deploy the Sigma rule “Detect Suspicious Solid Edge Process Execution” to identify potential exploitation attempts based on unusual process behavior.
Educate users about the risks of opening files from untrusted sources to mitigate social engineering attacks.
Monitor systems for unexpected process creations originating from Solid Edge SE2026, as this could indicate successful exploitation.

Solid Edge SE2026 Uninitialized Pointer Access Vulnerability (CVE-2026-44411)

hello@craftedsignal.io — Tue, 12 May 2026 10:21:19 +0000

A vulnerability, identified as CVE-2026-44411, exists in Solid Edge SE2026, specifically in versions prior to V226.0 Update 5. This flaw stems from an uninitialized pointer access during the parsing of maliciously crafted PAR files. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code within the security context of the user running the affected Solid Edge application. This could allow for complete system compromise if the user has elevated privileges. This vulnerability poses a significant threat to organizations relying on Solid Edge for CAD design, potentially leading to data breaches, system instability, or unauthorized access.

Attack Chain

An attacker crafts a malicious PAR file specifically designed to trigger the uninitialized pointer access vulnerability in Solid Edge.
The attacker delivers the crafted PAR file to a target user, potentially through social engineering or embedding it within a seemingly legitimate project.
The user opens the malicious PAR file using a vulnerable version of Solid Edge SE2026.
Solid Edge attempts to parse the PAR file, triggering the uninitialized pointer access.
The uninitialized pointer dereference leads to a controlled crash or allows the attacker to overwrite memory.
The attacker leverages the memory corruption to inject and execute arbitrary code.
The injected code executes within the context of the Solid Edge process, inheriting its privileges.
The attacker gains control of the compromised system, potentially leading to data theft, further lateral movement, or system disruption.

Impact

Successful exploitation of CVE-2026-44411 can lead to arbitrary code execution on the affected system. This could allow an attacker to gain complete control of the compromised machine, potentially leading to data theft, system instability, or further lateral movement within the network. The vulnerability affects Solid Edge SE2026 (All versions < V226.0 Update 5). Organizations relying on Solid Edge for CAD design are at risk.

Recommendation

Upgrade Solid Edge SE2026 to version V226.0 Update 5 or later to patch CVE-2026-44411.
Deploy the Sigma rule “Detect Suspicious File Opening in Solid Edge” to detect potential exploitation attempts.
Educate users about the risks of opening untrusted PAR files and encourage them to verify the source before opening any such files.
Monitor process creation events for Solid Edge processes spawning unusual child processes, using the provided Sigma rules.

Siemens Teamcenter Vulnerability CVE-2026-33862 - Cross-Site Scripting

hello@craftedsignal.io — Tue, 12 May 2026 10:20:50 +0000

A cross-site scripting (XSS) vulnerability, identified as CVE-2026-33862, affects multiple versions of Siemens Teamcenter. Specifically, Teamcenter V2312 (all versions before V2312.0014), Teamcenter V2406 (all versions before V2406.0012), Teamcenter V2412 (all versions before V2412.0009), Teamcenter V2506 (all versions before V2506.0005), and Teamcenter V2512 are impacted. The vulnerability stems from the application’s failure to properly encode or filter user-supplied data. This flaw allows a remote attacker to inject malicious scripts into the application that can then be executed by other users when they interact with the affected page, potentially leading to data theft, session hijacking, or other malicious activities. The vulnerability was reported on 2026-05-12.

Attack Chain

An attacker crafts a malicious payload containing JavaScript code.
The attacker injects the payload into a vulnerable Teamcenter input field, such as a comment, name, or description.
The attacker submits the form or triggers the action that saves the malicious input to the Teamcenter database.
A legitimate user accesses the page or resource where the injected payload is displayed.
The victim’s web browser executes the attacker-controlled JavaScript code within the context of the Teamcenter web application.
The malicious script can then perform actions such as stealing the user’s session cookies, redirecting the user to a malicious website, or modifying the content of the page.
The attacker can use the stolen session cookie to impersonate the user and gain unauthorized access to Teamcenter.

Impact

Successful exploitation of this XSS vulnerability (CVE-2026-33862) could lead to the execution of arbitrary JavaScript code in the context of other Teamcenter users’ browsers. This can result in session hijacking, theft of sensitive information, defacement of the application, or redirection to malicious websites. Given the potential for unauthorized access and data manipulation, this vulnerability poses a significant risk to organizations using affected versions of Siemens Teamcenter.

Recommendation

Upgrade to the latest versions of Teamcenter: V2312.0014, V2406.0012, V2412.0009, V2506.0005, or V2512 to remediate CVE-2026-33862 (see references).
Deploy the Sigma rule Detect Suspicious Teamcenter URI Activity to identify potential exploitation attempts by monitoring for specific patterns in HTTP requests.
Implement input validation and output encoding mechanisms within the Teamcenter application to prevent XSS attacks.

Siemens RUGGEDCOM ROX Devices Vulnerable to Remote Code Execution via Feature Key Injection (CVE-2025-40947)

hello@craftedsignal.io — Tue, 12 May 2026 10:19:32 +0000

A remote code execution vulnerability, tracked as CVE-2025-40947, affects multiple RUGGEDCOM ROX devices. The affected devices include RUGGEDCOM ROX MX5000, MX5000RE, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536, and RX5000, specifically all versions prior to V2.17.1. The vulnerability stems from a failure to properly sanitize user-supplied input during the feature key installation process. An authenticated attacker can exploit this flaw to inject arbitrary commands, leading to remote code execution with root privileges on the underlying operating system. This vulnerability poses a significant risk to industrial control systems relying on these devices.

Attack Chain

An attacker gains authenticated access to the RUGGEDCOM ROX device’s management interface.
The attacker crafts a malicious feature key containing embedded operating system commands.
The attacker uploads the crafted feature key to the device through the management interface.
The RUGGEDCOM ROX device attempts to install the feature key without proper input sanitization.
The injected commands within the feature key are executed with root privileges.
The attacker gains arbitrary code execution on the device’s underlying operating system.
The attacker can then establish persistence by modifying system files.
The attacker can pivot to other internal assets, disrupt operations, or exfiltrate sensitive data.

Impact

Successful exploitation of CVE-2025-40947 allows an attacker to execute arbitrary code with root privileges on vulnerable RUGGEDCOM ROX devices. This could lead to complete system compromise, denial of service, disruption of critical infrastructure, and potential lateral movement to other systems within the network. The vulnerability targets industrial control systems, potentially impacting sectors such as energy, transportation, and manufacturing.

Recommendation

Upgrade all affected RUGGEDCOM ROX devices (MX5000, MX5000RE, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536, and RX5000) to version V2.17.1 or later to patch CVE-2025-40947.
Monitor network traffic for suspicious activity related to feature key uploads to detect potential exploitation attempts. Deploy the Sigma rule Detect Suspicious Feature Key Uploads to identify such activity.
Review the logs for any unusual processes or commands executed on the RUGGEDCOM ROX devices that may indicate successful exploitation. Utilize the Sigma rule Detect Malicious Command Execution via Feature Key Injection for this purpose.

Siemens SIMATIC CN 4100 Unauthenticated Resource Exhaustion (CVE-2026-22924)

hello@craftedsignal.io — Tue, 12 May 2026 10:18:09 +0000

A vulnerability, CVE-2026-22924, affects Siemens SIMATIC CN 4100 devices running versions prior to V5.0. This security flaw stems from the application’s failure to adequately restrict unauthenticated connections. As a result, an attacker can exploit this weakness to trigger resource exhaustion conditions. By overwhelming the system with unauthenticated requests, a malicious actor could disrupt normal operations, perform unauthorized actions, and compromise both the availability and integrity of the SIMATIC CN 4100 device. Successful exploitation could lead to significant operational downtime and potential data breaches. This vulnerability poses a substantial risk to industrial control systems (ICS) environments relying on SIMATIC CN 4100.

Attack Chain

Attacker identifies a vulnerable SIMATIC CN 4100 device exposed on the network.
Attacker establishes an unauthenticated connection to the device.
Attacker sends a high volume of requests to a resource-intensive endpoint.
The SIMATIC CN 4100 device attempts to process each request, consuming system resources.
The device’s CPU and memory resources become depleted due to the overwhelming number of requests.
Legitimate requests from authorized users are delayed or dropped.
The SIMATIC CN 4100 device becomes unresponsive or crashes, leading to a denial-of-service condition.
Industrial processes relying on the SIMATIC CN 4100 device are disrupted or halted.

Impact

Successful exploitation of CVE-2026-22924 can result in a denial-of-service condition on the SIMATIC CN 4100 device, disrupting critical industrial processes. This may lead to operational downtime, financial losses, and potential safety hazards. The vulnerability affects all versions of SIMATIC CN 4100 prior to V5.0, potentially impacting a wide range of industrial sectors that rely on these devices for network communication.

Recommendation

Upgrade SIMATIC CN 4100 devices to version V5.0 or later to remediate CVE-2026-22924.
Implement network segmentation and access control measures to limit exposure of SIMATIC CN 4100 devices to untrusted networks.
Deploy the Sigma rule “Detect SIMATIC CN 4100 Unauthenticated Connection Attempts” to identify suspicious unauthenticated connection patterns to the device.
Monitor network traffic to SIMATIC CN 4100 devices for unusually high connection rates and resource consumption.
Apply the mitigations recommended by Siemens in their security advisory SSA-032379.

CVE-2025-40949 - Siemens RUGGEDCOM ROX Web UI Command Injection

hello@craftedsignal.io — Tue, 12 May 2026 10:17:37 +0000

A critical command injection vulnerability, identified as CVE-2025-40949, affects multiple RUGGEDCOM ROX devices. Specifically, the vulnerability resides in the Scheduler functionality of the Web UI. Versions prior to V2.17.1 of the RUGGEDCOM ROX MX5000, MX5000RE, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536, and RX5000 are affected. The root cause of this vulnerability is the insufficient sanitization of user-supplied input, which allows an authenticated attacker to inject arbitrary commands into the task scheduling backend. Successful exploitation allows a remote attacker to execute arbitrary commands with root privileges on the underlying operating system of the affected device. This poses a significant risk to industrial control systems (ICS) environments where these devices are commonly deployed.

Attack Chain

An attacker gains authenticated access to the RUGGEDCOM ROX Web UI.
The attacker navigates to the Scheduler functionality within the Web UI.
The attacker injects malicious commands into a user-supplied input field (e.g., task name, command to execute, schedule).
The injected commands are not properly sanitized by the application.
When the scheduler processes the task, the injected commands are executed by the underlying operating system with root privileges.
The attacker achieves arbitrary command execution, potentially allowing them to install malware, modify configurations, or disrupt operations.
The attacker leverages the initial access to pivot to other network resources or maintain persistence on the device.

Impact

Successful exploitation of CVE-2025-40949 allows an authenticated remote attacker to execute arbitrary commands with root privileges on the RUGGEDCOM ROX device. This could lead to complete system compromise, allowing the attacker to disrupt critical infrastructure operations, steal sensitive data, or use the compromised device as a pivot point to attack other systems within the network. Given the widespread use of RUGGEDCOM devices in industrial control systems, the potential impact is significant and could affect various sectors, including energy, transportation, and manufacturing.

Recommendation

Upgrade all affected RUGGEDCOM ROX devices to version V2.17.1 or later to patch CVE-2025-40949.
Monitor web server logs for suspicious activity related to the Scheduler functionality of the Web UI (reference: webserver log source).
Implement the Sigma rules provided below to detect potential exploitation attempts targeting CVE-2025-40949.