A stored XSS vulnerability in Siemens SIMATIC controller web interfaces allows authenticated attackers to execute malicious scripts within the sessions of other users.

The vulnerability is a stored Cross-Site Scripting (CWE-79) issue caused by improper sanitization of Technology Object (TO) names. An attacker with authorization to download TIA projects can inject scripts that execute when a benign user views the "Motion Control Diagnostics" page.

Successful exploitation allows an attacker to hijack the web sessions of authorized personnel, potentially leading to unauthorized control over industrial diagnostics and settings. Given the CVSS score of 9.1, this presents a significant risk to the integrity and availability of industrial control environments, potentially causing operational disruption.

Immediate Action: Apply the recommended firmware updates provided in Siemens Security Advisory SSA-688146.

Proactive Monitoring: Monitor the web interface for any unexpected script execution or anomalous modifications to system configuration parameters.

Compensating Controls: Restrict access to the "Motion Control Diagnostics" page and the TIA project download function to only the most trusted, essential personnel to reduce the attack surface.

Public Exploit Available: No

Organizations operating Siemens SIMATIC infrastructure should verify their current firmware versions against the vendor advisory. Immediate patching is recommended to secure the management interface, as XSS vulnerabilities in industrial control systems can be leveraged to gain persistence and control over critical operational technology.