Simatic S7-1500 Software Controller Linux V3 (Siemens) - vulnerabilities (CVEs)
15 CVEs, 8 in the last 30 days, 2 known versions, newest CVE from 2026-10-13. Vendor: Siemens.
CVEs of Simatic S7-1500 Software Controller Linux V3
- CVE-2026-63357 - CVSS 6.1 (medium), 2026-10-13: Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page. This…
- CVE-2026-63356 - CVSS 6.1 (medium), 2026-10-13: Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace…
- CVE-2026-63355 - CVSS 6.1 (medium), 2026-10-13: Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page. This…
- CVE-2026-63354 - CVSS 9.6 (critical), 2026-10-13: Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This…
- CVE-2026-63353 - CVSS 9.6 (critical), 2026-10-13: Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an…
- CVE-2026-63352 - CVSS 6.1 (medium), 2026-10-13: Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page. This could allow…
- CVE-2026-63351 - CVSS 6.1 (medium), 2026-10-13: Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on…
- CVE-2026-63350 - CVSS 9.6 (critical), 2026-10-13: Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized…
- CVE-2026-25789 - CVSS 7.2 (high), 2026-05-12: Affected devices do not properly validate and sanitize filenames on the Firmware Update page. This could allow a remote attacker to social engineer the user…
- CVE-2026-25787 - CVSS 9.3 (critical), 2026-05-12: Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface.…
- CVE-2026-25786 - CVSS 9.3 (critical), 2026-05-12: Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface. This could allow…
- CVE-2025-40943 - CVSS 9.6 (critical), 2026-03-10: Affected devices do not properly sanitize contents of trace files. This could allow an attacker to inject code through social engineering an authorized user,…
- CVE-2023-37482 - CVSS 6.9 (medium), 2025-02-11: The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker…
- CVE-2024-46887 - CVSS 6.9 (medium), 2024-10-08: The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an…
- CVE-2024-46886 - CVSS 5.1 (medium), 2024-10-08: The web server of affected devices does not properly validate input that is used for a user redirection. This could allow an attacker to make the server…
