Full Report
A reflected cross site scripting vulnerability in the authentication redirect flow (/auth/) of Teamcenter allows an unauthenticated remote attacker to inject JavaScript into an authenticated user’s session by crafting a malicious URL. Successful exploitation may enable the attacker to read data or perform actions within the victim’s Teamcenter session. Siemens has released new versions for the affected products and recommends to update to the latest versions.
Analysis Summary
# Vulnerability: Reflected Cross-Site Scripting (XSS) in Siemens Teamcenter
## CVE Details
- **CVE ID:** CVE-2026-58113
- **CVSS Score:** 6.1 (Medium) via v3.1 / 8.5 (High) via v4.0
- **CWE:** CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
## Affected Systems
- **Products:** Siemens Teamcenter
- **Versions:**
- Teamcenter V2412: All versions < V2412.0013
- Teamcenter V2506: All versions < V2506.0010
- Teamcenter V2512: All versions < V2512.2607
- Teamcenter V2606: All versions < V2606.2607
- **Configurations:** Systems utilizing the authentication redirect flow via the `/auth/` endpoint.
## Vulnerability Description
A reflected cross-site scripting (XSS) vulnerability exists within the Teamcenter authentication redirect flow (`/auth/`). The application fails to properly encode user-supplied input when it is reflected into HTML attribute contexts. By crafting a malicious URL, an unauthenticated remote attacker can inject and execute arbitrary JavaScript within the browser session of an authenticated user.
## Exploitation
- **Status:** Not specified as exploited in the wild (Reported by Enzo Alvarez from Bishop Fox).
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
- **User Interaction:** Required (Victim must click a crafted link).
## Impact
- **Confidentiality:** High (Attacker can read sensitive data within the session).
- **Integrity:** High (Attacker can perform unauthorized actions on behalf of the victim).
- **Availability:** None reported.
## Remediation
### Patches
Siemens recommends updating to the following versions or later:
- **V2412:** Update to V2412.0013
- **V2506:** Update to V2506.0010
- **V2512:** Update to V2512.2607
- **V2606:** Update to V2606.2607
### Workarounds
No specific software workarounds were provided. Siemens recommends general security best practices:
- Protect network access to devices with appropriate perimeter security.
- Follow Siemens' operational guidelines for Industrial Security.
## Detection
- **Indicators of Compromise:** Monitor web server logs for the `/auth/` endpoint containing suspicious or encoded JavaScript payloads (e.g., `<script>`, `onerror=`, `onload=`) in URL parameters.
- **Detection methods:** Web Application Firewalls (WAF) can be configured to detect and block common XSS patterns targeting the authentication redirect flow.
## References
- **Vendor Advisory:** SSA-157465 [https://cert-portal.siemens.com/productcert/pdf/ssa-157465.pdf] (Defanged: hxxps://cert-portal.siemens.com/productcert/html/ssa-157465.html)
- **Siemens Support:** hxxps://support.sw.siemens.com/product/282219420/
- **Industrial Security Guidelines:** hxxps://www.siemens.com/cert/operational-guidelines-industrial-security