CVE-2025-40943
CVSS 9.6 CRITICAL: affected devices do not properly sanitize contents of trace files. EPSS 0.5% (36th percentile).
Vulnerabilities · 187 days ago
The web interface flaw can allow code injection if a legitimate user imports a specially crafted trace file. Siemens has released patches for multiple models and is preparing additional fixes.
CVSS 9.6 CRITICAL: affected devices do not properly sanitize contents of trace files. EPSS 0.5% (36th percentile).
1 source covering this story
Siemens SIMATIC Summary SIMATIC S7-1500 devices contain a vulnerability that could allow an attacker to inject code by tricking a legitimate user into importing a specially crafted trace file in the web interface.
Part of the PlainSec briefing for 2026-03-13