Siemens SIMATIC S7-1500 Web Server Stored XSS via Trace File Visual Marker Data

#!/usr/bin/env bash
# check_s7_web.sh — CVE-2026-63354 exposure check for Siemens S7-1500 web server
# Tests whether the PLC web server is enabled and serving the SIMATIC Trace UI.
# All firmware versions are affected; if the web server responds, the device is VULNERABLE.
# Exit codes: 0 = VULNERABLE, 1 = PATCHED/NOT EXPOSED, 2 = UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <PLC_IP_OR_HOSTNAME>"
  exit 2
fi

TARGET="$1"
TIMEOUT=5
RESULT="UNKNOWN"

echo "[*] CVE-2026-63354 — Siemens S7-1500 Web Server Exposure Check"
echo "[*] Target: ${TARGET}"
echo "[*] Date:   $(date -u +%Y-%m-%dT%H:%M:%SZ)"
echo ""

# Try HTTPS first, fall back to HTTP
for PROTO in https http; do
  PORT=443
  [ "$PROTO" = "http" ] && PORT=80

  echo "[*] Probing ${PROTO}://${TARGET}:${PORT} ..."

  RESPONSE=$(curl -sk --connect-timeout "${TIMEOUT}" --max-time 10 \
    -o /dev/null -w "%{http_code}" \
    "${PROTO}://${TARGET}:${PORT}/" 2>/dev/null || echo "000")

  if [ "$RESPONSE" != "000" ]; then
    echo "[+] Web server responded on port ${PORT} (HTTP ${RESPONSE})"

    # Check for SIMATIC signature in response headers or body
    BODY=$(curl -sk --connect-timeout "${TIMEOUT}" --max-time 10 \
      "${PROTO}://${TARGET}:${PORT}/" 2>/dev/null || true)

    if echo "$BODY" | grep -qi -e "simatic" -e "S7-1500" -e "siemens" -e "plc" -e "webserver"; then
      echo "[+] SIMATIC web interface signature detected."
      echo ""
      echo "=== VULNERABLE ==="
      echo "The S7-1500 web server is enabled and serves the SIMATIC interface."
      echo "All firmware versions are affected by CVE-2026-63354 (no patch available)."
      echo "Mitigation: Disable the web server or restrict ports 80/443 to trusted IPs."
      exit 0
    else
      echo "[-] Web server responded but no SIMATIC signature found."
      RESULT="UNKNOWN"
    fi
  else
    echo "[-] No response on port ${PORT}."
  fi
done

# If we reach here, no SIMATIC web server was detected
if [ "$RESULT" = "UNKNOWN" ]; then
  echo ""
  echo "=== UNKNOWN ==="
  echo "A web server responded but could not be confirmed as SIMATIC S7-1500."
  echo "Manually verify the device identity and web server configuration."
  exit 2
fi

echo ""
echo "=== PATCHED ==="
echo "No web server detected on ports 80/443. The PLC web server appears disabled."
echo "If the web server is confirmed disabled, CVE-2026-63354 is not exploitable."
exit 1