Siemens SIMATIC S7-1500 Web Server Vulnerabilities (CVE-2026-63350–63357): Detection and Mitigation Guide for ICS Defenders

CISA has published ICSA-26-295-14 covering eight distinct vulnerabilities (CVE-2026-63350 through CVE-2026-63357) in the embedded web server of Siemens SIMATIC S7-1500 series controllers, including the SIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0) and CPU 1507D TF (6ES7615-7DF10-0AB0), all versions affected. The advisory language is the part that should get your attention: an attacker can execute malicious code in an authorized user's browser session and perform PLC operations within the scope of that user's authorization.

Read that again in operational terms. If your lead controls engineer is logged into the PLC's web interface — checking diagnostics, reviewing the module status page, pulling a firmware inventory — and that engineer browses to attacker-controlled content in the same browser, the attacker inherits the engineer's authenticated session context against the PLC. On an S7-1500, an authorized user can stop the CPU, modify program blocks, change device configuration, and write to process memory. That is not a web application nuisance. That is a path to physical process manipulation.

Siemens is preparing fixes but they are not yet available for all affected products, which makes this a mitigation-and-detection problem right now. If you run S7-1500s with the web server enabled, this is an action item this week, not next quarter.

Technical Analysis

Affected Products

Per the CISA advisory and Siemens' CSAF distribution, confirmed affected products include:

The advisory affects the broader S7-1500 web server implementation — defenders should consult the Siemens CSAF document and ProductCERT advisory for the complete product matrix, as additional S7-1500 CPUs, F-variants, T-variants, and ET 200SP Open Controllers sharing the same web server codebase are typically implicated in these bulletins.

The Vulnerability Class

The eight CVEs (CVE-2026-63350 through CVE-2026-63357) cluster around a classic and dangerous pattern in embedded device web interfaces: client-side script execution in the context of an authenticated session — i.e., cross-site scripting (XSS) and related browser-side injection weaknesses in the PLC's built-in web server, combined with the absence of robust session-riding protections (CSRF).

The exploitation chain from a defender's perspective:

1. Prerequisite — the web server is enabled. The S7-1500 web server is disabled by default but is commonly enabled in the field for diagnostics access, watch tables, and remote maintenance. Every enabled instance on a reachable network segment is attack surface.
2. Prerequisite — an authorized user must be coerced. The attacker needs a legitimately authenticated engineer or operator to visit attacker-influenced content — via a spear-phishing link, a compromised internal portal, a watering hole on an OT documentation site, or injected content reflected through the PLC's own pages.
3. Payload execution in the session context. The malicious script runs in the victim's browser with the origin of the PLC web server. From there it can issue arbitrary requests to the web API endpoints the engineer is authorized to use — reading diagnostics is the benign end; the malicious end is invoking PLC operations (mode changes, project data manipulation) within the victim's authorization scope.
4. No direct PLC exploit is needed. The attacker never exploits the PLC's control protocol stack. They ride the legitimate management plane. This is why traditional ICS intrusion detection tuned to S7comm/ISO-TSAP anomalies will see nothing unusual — the traffic is HTTPS between the engineer's workstation and the PLC.

Exploitation Status

As of publication, there is no public proof-of-concept and no confirmed in-the-wild exploitation, and these CVEs are not listed in CISA's Known Exploited Vulnerabilities catalog. However, two factors compress the timeline: (1) embedded web XSS/CSRF classes are well understood by ICS-focused threat researchers and historically get weaponized quickly after disclosure, and (2) the victim-coercion model means exploitation leaves almost no forensic trace on the PLC itself. Treat this as pre-exploitation window exposure — the cheapest remediation you will ever get.

Why the Management Plane Matters Here

I've responded to OT intrusions where the adversary never touched a memory-corruption bug in a controller. They walked in through engineering workstations and HMI web consoles and used the sanctioned tools. This advisory describes exactly that pattern, baked into the product's own web server. If your S7-1500 web interfaces are reachable from general-purpose IT networks — or worse, exposed through remote access jump boxes without isolation — you have handed an attacker a session-hijacking primitive against your process control layer.

Detection & Response

This is a technical ICS threat, and the honest detection reality is this: the PLC itself generates almost no useful telemetry. Your detection must live at the network perimeter of the OT zone and on the engineering workstations whose browsers are the actual exploitation surface. The rules below are tuned for that model.

Sigma Rules

These rules target the engineering-workstation browser side and the network-path side, where this attack is actually observable.

---
title: HTTP Request to SIMATIC S7 Web Server from Non-Engineering Host
id: 3f8a1c2e-7b4d-4e91-a6c3-2d5f8e9b0a11
status: experimental
description: Detects HTTP/HTTPS requests to Siemens S7-1500 embedded web server ports from hosts outside the authorized engineering workstation set. XSS/CSRF exploitation against CVE-2026-63350 through CVE-2026-63357 requires the victim browser to reach the PLC web interface; requests from unexpected hosts indicate lateral probing or redirected victim traffic.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-14
  - https://attack.mitre.org/techniques/T0859/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.ics
  - attack.t0859
  - attack.t1190
logsource:
  category: webserver
  product: proxy
detection:
  selection:
    c-uri|contains:
      - '/awp/'
      - '/Portal/Portal.mwsl'
      - '/webserver/'
    sc-status: 200
falsepositives:
  - Authorized engineering workstation diagnostic sessions (whitelist source IPs of known TIA Portal / engineering hosts)
  - OT asset inventory scanners
level: medium
---
title: Browser Launched with URL Targeting Internal PLC Web Interface
id: 8c2e4f1a-5d6b-4c78-9e2f-1a3b7d9c0e22
status: experimental
description: Detects browser processes launched via command line with URLs pointing to internal OT-segment IP addresses on HTTP/HTTPS. Phishing-driven delivery for SIMATIC web server session hijack (CVE-2026-63350 - CVE-2026-63357) typically results in a browser spawned with an attacker-crafted URL. RFC1918 destinations on web ports from a freshly spawned browser on an engineering workstation warrant review.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-14
  - https://attack.mitre.org/techniques/T1566/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1566.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  selection_url:
    CommandLine|contains:
      - 'http://10.'
      - 'http://172.16.'
      - 'http://192.168.'
      - 'https://10.'
      - 'https://172.16.'
      - 'https://192.168.'
  condition: selection_img and selection_url
falsepositives:
  - Administrators launching internal web portals from shortcuts (tune by OT subnet and known portal hosts)
level: low
---
title: Browser Process Spawning Script Interpreter or Command Shell
id: b51d9a77-3e28-4f05-ac94-6f2c8d1e5a33
status: experimental
description: Detects cmd.exe, powershell.exe, wscript.exe, or mshta.exe spawned as a child of a web browser. Browser-originated script execution is a common post-delivery stage in session-hijack and drive-by campaigns, including delivery chains that would precede exploitation of SIMATIC web server browser-session vulnerabilities.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-14
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\iexplore.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare: browser-integrated enterprise tooling; legitimate 'open file' handlers (constrain with command-line review)
level: high

KQL — Microsoft Sentinel / Defender

This hunt assumes your OT DMZ firewall, web proxy, or ICS monitoring sensor forwards logs into Sentinel via CommonSecurityLog (CEF) or Syslog. The first query hunts traffic to S7 web servers crossing zone boundaries; the second hunts browser child-process anomalies on engineering workstations via Defender for Endpoint.

// Hunt 1: Traffic to SIMATIC S7 web servers from non-authorized sources
// Replace the allowed-source list with your authorized engineering workstation IPs
let AuthorizedEWS = dynamic(["10.10.20.11","10.10.20.12","10.10.20.15"]);
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort in (80, 443, 8080)
| where DestinationIP startswith "10.30."  // <-- scope to your OT/PLC subnet
| where SourceIP !in (AuthorizedEWS)
| extend SuspiciousPath = iff(RequestURL has_any ("/awp/","/Portal/","/webserver/"), "S7 Web API Path", "Other")
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Paths = make_set(RequestURL, 20)
    by SourceIP, DestinationIP, DestinationPort, SuspiciousPath
| order by FirstSeen desc;

// Hunt 2: Browser spawning script interpreters on engineering workstations (delivery-stage detection)
let BrowserList = dynamic(["chrome.exe","msedge.exe","firefox.exe","iexplore.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ (BrowserList)
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc;

Velociraptor VQL — Engineering Workstation Hunt

If you suspect a specific engineering workstation's browser session was targeted, hunt for script-interpreter children of browser processes and live network connections from the browser into OT segments. This is the fastest triage before you pull full browser history artifacts.

-- Hunt: browser child processes and browser connections into OT subnets
-- Scope to engineering workstations via your Velociraptor client label/group
SELECT Pid, PPid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32)'
  AND Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32)'

-- Correlate: which browsers hold live connections into the PLC segment?
SELECT Pid, Name, Status, Laddr, Lport, Raddr, Rport
FROM netstat()
WHERE Name =~ '(?i)(chrome|msedge|firefox|iexplore)'
  AND Raddr =~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)'
  AND Rport in (80, 443, 8080)

Hardening Script — Inventory and Exposure Reduction

Fixes are not available for all affected products yet, so your immediate job is finding every reachable S7 web server and restricting who can talk to it. This script inventories S7 web interfaces on a given subnet from a Linux jump host and is safe to run read-only — it does not authenticate or touch the PLC beyond a TCP connect and HTTP banner fetch.

#!/bin/bash
# Security Arsenal - SIMATIC S7-1500 Web Server Exposure Inventory (CVE-2026-63350 - CVE-2026-63357)
# Read-only discovery. Run from an OT jump host. Usage: ./s7_webserver_audit.sh 10.30.0.0/24

TARGET="${1:?Usage: $0 <CIDR-subnet>}"
OUT="s7_web_audit_$(date +%Y%m%d_%H%M%S).csv"

echo "ip,port,http_status,server_header,title_hint" > "$OUT"

# Discover hosts listening on common S7 web server ports
mapfile -t HOSTS < <(nmap -Pn -p80,443,8080 --open -oG - "$TARGET" | awk '/Ports:/{print $2}')

for ip in "${HOSTS[@]}"; do
  for port in 80 443 8080; do
    scheme="http"; [ "$port" = "443" ] && scheme="https"
    resp=$(curl -sk --max-time 5 -o /dev/null -w "%{http_code}" "$scheme://$ip:$port/" 2>/dev/null)
    [ "$resp" = "000" ] && continue
    hdr=$(curl -skI --max-time 5 "$scheme://$ip:$port/" 2>/dev/null | grep -i '^server:' | tr -d '\r' | cut -d' ' -f2-)
    title=$(curl -sk --max-time 5 "$scheme://$ip:$port/" 2>/dev/null | grep -io '<title>[^<]*' | head -1 | sed 's/<title>//I')
    # S7-1500 web server pages typically reference SIMATIC / awp paths
    if echo "${hdr}${title}" | grep -qiE 'simatic|siemens|s7-|awp'; then
      echo "[!] PROBABLE SIMATIC WEB SERVER: $ip:$port ($title)"
    fi
    echo "$ip,$port,$resp,\"$hdr\",\"$title\"" >> "$OUT"
  done
done

echo "[*] Results written to $OUT — review every hit against your authorized-web-server baseline."

Remediation

1. Apply Siemens fixes the moment they ship. Siemens states fixes are in preparation and has published mitigations for products where fixes are not or not yet available. Subscribe to Siemens ProductCERT (siemens.com/cert) and pull the CSAF document referenced in ICSA-26-295-14 so you are notified the instant firmware for CPU 1504D TF / 1507D TF and related S7-1500 variants drops. Do not wait for your next maintenance window cycle to plan this — schedule the window now.

2. Disable the web server where it is not operationally required. In TIA Portal device configuration, the "Web server on this module" option can be deactivated and pushed to the CPU. Every disabled instance is a permanently eliminated attack path for all eight CVEs. Audit your fleet — in my experience, a meaningful percentage of S7-1500s in the field have the web server enabled for a diagnostic session that ended two years ago.

3. Enforce network-level access control immediately. Where the web server must stay enabled, restrict TCP 80/443/8080 access to the PLC to an explicit allowlist of engineering workstation IPs at the OT zone firewall or industrial DMZ. This is the single highest-value mitigation available today: it breaks the attacker-delivery requirement that the victim browser reach the PLC from arbitrary contexts. Per IEC 62443 zoning principles, PLC management interfaces should never be reachable from general IT or internet-facing segments.

4. Harden the browser side on engineering workstations. Since exploitation rides the engineer's browser: enforce a dedicated browser profile (or dedicated jump host) for OT management access that is never used for email, general web browsing, or SaaS access; block third-party content and external navigation from that profile via policy; and ensure engineers fully log out of PLC web sessions when finished rather than leaving sessions resident.

5. Review phishing exposure for OT staff. The delivery model is victim coercion. Brief controls engineers and maintenance staff on this advisory specifically — generic phishing training does not cover "a link that hijacks your PLC session." Flag and sandbox-detain inbound links to internal OT addresses at the email gateway.

6. Follow CISA's standard ICS guidance. CISA reiterates in this advisory: minimize network exposure for all control system devices, ensure they are not accessible from the internet, locate control system networks behind firewalls isolated from business networks, and when remote access is required use secure methods such as up-to-date VPNs — recognizing that VPNs are only as secure as their connected devices. There is no KEV deadline because these CVEs are not in KEV — which means your remediation clock is set by how fast exploit code matures, not by a compliance date. Move accordingly.

7. Validate with your asset inventory. If you cannot answer "how many S7-1500s do we have with the web server enabled, and who can reach them" within an hour, that gap is its own incident waiting to happen. Use the audit script above, reconcile against your OT asset inventory, and close the loop.

The bottom line: eight CVEs, no patches for everything yet, an exploitation model that inherits your most privileged OT users' authority, and near-zero on-device forensic visibility. Exposure reduction and zone-level access control are your primary defenses until Siemens firmware lands. Do the inventory this week.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub