Siemens TIA Portal vulnerabilities

The vulnerability in industrial devices is due to improper validation and sanitization of the Technology Object (TO) name displayed on the 'Motion Control Diagnostics' page of the web interface. This allows an authenticated attacker authorized to download a TIA project into the device to inject malicious scripts into the page.

Affected devices do not properly validate and sanitize PLC/station name rendered on the communication parameters page of the web interface. This allows an authenticated attacker authorized to download a TIA project into the product to inject malicious scripts. If a benign user with appropriate rights accesses the page, the malicious code executes in their session context.

A vulnerability in Siemens SIMATIC and TIA Portal products is caused by improper sanitization of stored security properties when parsing project files. An attacker can exploit this to trigger a type confusion and execute arbitrary code within the affected application.