Industrial Alert: Critical Stored XSS Vulnerability Discovered in Siemens SIMATIC S7-1500

A critical Stored Cross-Site Scripting (XSS) vulnerability (CVE-2025-40943, CVSS 9.6) was disclosed in the Siemens SIMATIC S7-1500 CPU family and related devices; an attacker can cause an authorized user to import a crafted trace file via the web interface to inject malicious code, potentially enabling unauthorized control or data theft in industrial environments. Siemens has released firmware updates for many affected products and recommends restricting web access, validating trace files, and monitoring for anomalous web-interface activity while fixes for some models are prepared.