PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-25789 Siemens CVE debrief

CVE-2026-25789 is a Siemens SIMATIC PLC web-server issue in the Firmware Update page. Because filenames are not properly validated and sanitized, a remote attacker may socially engineer an authenticated user into selecting a modified firmware file name, leading to malicious JavaScript execution in that user’s session without the file actually being uploaded. The stated impact includes session hijacking or credential theft, and the source CVSS vector reflects network attack conditions with required user interaction and authenticated access.

Vendor
Siemens
Product
SIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0)
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-14
Advisory published
2026-05-12
Advisory updated
2026-05-14

Who should care

OT and ICS operators, plant engineers, and administrators responsible for Siemens SIMATIC S7 / ET 200SP / Drive Controller devices and any web-based firmware update workflow. This is especially relevant for teams that allow remote or broadly delegated access to device management interfaces.

Technical summary

The advisory describes improper filename validation/sanitization on the Firmware Update page. An attacker can craft a modified firmware filename and rely on user interaction to get an authenticated user to select it, which can execute JavaScript in the context of that session. The supplied CVSS vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating network reachability, high complexity, low privileges, and required user interaction.

Defensive priority

High. The attack requires user interaction and is high complexity, but the impact is severe and the affected device set is broad across Siemens OT products.

Recommended defensive actions

  • Apply Siemens vendor fixes where available, including the version-specific updates listed in the advisory such as V3.1.6 or later and V2.9.9 or later for the affected product families.
  • Restrict access to the firmware update function to instructed personnel only, as explicitly recommended by the advisory.
  • Limit access to device web management interfaces to trusted administrative networks and use OT segmentation/least-privilege controls from CISA ICS recommended practices.
  • Treat firmware update sessions as sensitive administrative actions and verify firmware package provenance before initiating any update workflow.
  • Track the Siemens and CISA advisories for product-specific remediation guidance, especially for variants where no fix is currently available or no fix is planned.

Evidence notes

This debrief is based on the supplied CISA CSAF source item ICSA-26-134-15, which republishes Siemens ProductCERT advisory SSA-688146 for CVE-2026-25789. The source dates are 2026-05-12 for publication and 2026-05-14 for republication/modification. The advisory references official Siemens and CISA pages, and the supplied remediation entries include both vendor fixes and a mitigation to restrict firmware update access to instructed personnel.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-25789 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-25789

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-25789 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-25789

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-134-15.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-688146.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-688146.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-15

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.