Siemens Warns of Eight Unpatched SIMATIC S7-1500 Web Server Flaws Rated Up to CVSS 9.4

Siemens disclosed eight vulnerabilities in SIMATIC S7-1500 controllers' web server Trace page (three rated critical, highest CVSS 9.6) that permit cross-site scripting when a malicious trace file is imported; exploited JavaScript can perform PLC operations within an authorized user's permissions. No confirmed in-the-wild exploitation or public proof-of-concept exists yet; Siemens is preparing fixes and urges mitigations now (disable webserver if unused, restrict ports 80/443, limit trace-file uploads, segment OT networks).