CISA republishes ten Siemens ICS advisories: S7-1500 web server bugs with no fix yet (CVSS 9.6), Industrial Edge path traversal (9.1), CROSSBOW SAC SQLite flaws (9.8)
On Oct 22 CISA republished a batch of Siemens ProductCERT advisories first released Oct 13. Highlights:
- SIMATIC S7-1500 / Drive Controller web server (ICSA-26-295-14, SSA-591731, CVE-2026-63350 to -63357, up to 9.6): eval injection and XSS, for example through a crafted trace file imported by a user with "Read diagnostics" rights, let attacker JavaScript perform PLC operations as that user. No fix yet: disable the web server if unused, restrict TCP 80/443 to trusted IPs, and only import trusted trace files.
- Industrial Edge devices (ICSA-26-295-17, SSA-832641, CVE-2026-44414/-44415, up to 9.1): authenticated path traversal to internal APIs; IECD, IEOD and IEVD are fixed in 1.28.1, while many HMI Comfort Pro models have no fix yet.
- RUGGEDCOM CROSSBOW Station Access Controller (ICSA-26-295-15, up to 9.8): SQLite flaws that can lead to code execution; update to 6.0.
- SIMATIC WinCC (ICSA-26-295-13, CVE-2026-59241, 8.8): a database role can run host commands; fixed in V8.0 Update 11 and V8.1 Update 7, with no fix for V7.5.
Other items in the batch cover S7-1500 MFP and TM MFP, the S7 Webserver API, CROSSBOW and RUGGEDCOM APE1808 (Nozomi Guardian/CMC bugs).
Sources: CISA ICS Advisories (Oct 22 batch) · CISA ICSA-26-295-14: Siemens SIMATIC S7 PLCs Web Server · CISA ICSA-26-295-17: Siemens Industrial Edge Devices · CISA ICSA-26-295-13: Siemens WinCC