CVE-2026-25787
CriticalSummary
Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the 'Motion Control Diagnostics' page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page.
Risk Assessment
Malicious code would be executed in the scope of a benign user's web session with appropriate rights, posing a risk of session hijacking or data theft.
Recommendation
It is recommended to implement proper input validation and sanitization mechanisms in the web interface and to monitor access to the diagnostics page.
Original NVD description (English source)
Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page. If a benign user with appropriate rights accesses the "Motion Control Diagnostics" parameters page, the malicious code would be executed in the scope of their web session.