Siemens Teamcenter Vulnerable to Reflected Cross-Site Scripting
A critical reflected cross-site scripting vulnerability in Siemens Teamcenter allows unauthenticated attackers to inject malicious JavaScript into user sessions via crafted URLs.
Siemens has issued a security advisory detailing a reflected cross-site scripting (XSS) vulnerability affecting multiple versions of its Teamcenter software. Identified as CVE-2026-58113, the flaw resides within the authentication redirect flow, specifically the /auth/ endpoint.
An unauthenticated remote attacker can exploit this vulnerability by crafting a malicious URL. When an authenticated user clicks on this specially designed link, the attacker can inject arbitrary JavaScript code into the user's active Teamcenter session. This injection occurs because the affected applications do not properly encode user-supplied input that is reflected back into HTML attribute contexts within the authentication process.
The potential impact of a successful exploitation is significant. Attackers could leverage the compromised session to read sensitive data that the victim user has access to, or perform unauthorized actions within the Teamcenter environment on behalf of the victim. This could lead to data theft, unauthorized modifications, or further compromise of the system.
The vulnerability affects several versions of Siemens Teamcenter, including V2412 (versions prior to 2412.0013), V2506 (versions prior to 2506.0010), V2512 (versions prior to 2512.2607), and V2606 (versions prior to 2606.2607). The Common Vulnerability Scoring System (CVSS) v3.1 base score for this vulnerability is 6.1, categorizing it as MEDIUM severity. The vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating it is network-exploitable, has low complexity, requires no privileges, needs user interaction (clicking a link), affects other components, and has low impact on confidentiality, integrity, and availability.
Siemens has addressed this vulnerability by releasing updated versions for all affected products. The company strongly recommends that users update to the latest available versions to mitigate the risk. Specific patch information and download links are available through Siemens' support portal, with updates recommended for V2412, V2506, V2512, and V2606.
The vulnerability was reported to Siemens by Enzo Alvarez from Bishop Fox. This type of XSS vulnerability is a common web security issue that can have serious consequences if not properly addressed, especially in enterprise software like Teamcenter, which manages product lifecycle data.
CISA advises organizations to minimize network exposure for all control system devices and ensure they are not accessible from the internet. They recommend locating control system networks behind firewalls and isolating them from business networks. When remote access is necessary, more secure methods like VPNs should be employed, ensuring they are kept updated. CISA also encourages performing thorough impact and risk assessments before deploying any defensive measures.
This advisory, originally published by Siemens as SSA-157465, highlights the ongoing need for vigilance in securing industrial control systems and enterprise software. Regular patching and adherence to security best practices remain crucial for protecting against such web-based threats.