An authenticated Stored Cross-site Scripting (XSS) vulnerability in Siemens SIMATIC controllers could allow an attacker with TIA project download privileges to compromise administrative sessions.

This is a Stored XSS vulnerability (CWE-79) triggered by improper sanitization of PLC/station names on the web interface's communication page. It requires an authenticated attacker with specific project deployment privileges to inject code that executes when a benign user accesses the page.

Successful exploitation allows for the execution of malicious scripts within the web session of other authorized users, potentially leading to unauthorized configuration changes or session hijacking. Given the 9.1 CVSS score, the impact on system integrity and availability is severe, particularly in industrial environments where unauthorized PLC control poses significant operational risks.

Immediate Action: Update affected SIMATIC devices to the versions specified in the Siemens security advisory (V3.1.6 or V2.9.9, respectively).

Proactive Monitoring: Audit access logs for the web interface and monitor for unusual script-based traffic or unexpected modifications to communication parameter settings.

Compensating Controls: Restrict access to the device web interface to trusted management networks and enforce strict role-based access control (RBAC) for TIA project download permissions.

Public Exploit Available: Unknown

The high CVSS severity necessitates prompt attention, despite the requirement for initial authentication. Administrators should prioritize firmware updates to close the injection vector and verify that only authorized personnel have the necessary permissions to interface with the affected TIA projects.