Full Report
The si-map component does not properly neutralize user-controllable input of the points property that is used to render the tooltip label of map pins. This could allow an attacker to craft a malicious URL that, when loaded by a victim and the map pin is hovered over, executes arbitrary script code within the victim’s browser session. This vulnerability affects only the @siemens/maps-ng package. Siemens has released new versions for the affected products and recommends to update to the latest versions.
Analysis Summary
# Vulnerability: Cross-Site Scripting (XSS) in Siemens Element Maps
## CVE Details
- **CVE ID:** CVE-2026-66155
- **CVSS Score:** 7.6 (High) - CVSS v3.1 / 7.0 (High) - CVSS v4.0
- **CWE:** CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
## Affected Systems
- **Products:** `@siemens/maps-ng` package (Element Maps)
- **Versions:**
- V47: All versions < V47.12.3
- V48: All versions < V48.11.3
- V49: All versions < V49.16.1
- **Configurations:** The vulnerability is specifically located within the `si-map` component.
## Vulnerability Description
The `si-map` component fails to properly neutralize user-controllable input via the `points` property. This property is utilized to render tooltip labels for map pins. Because the input is not sanitized, an attacker can inject malicious scripts into the `points` property. When a victim visits a page containing the malicious map pin and hovers over it, the script executes within the context of the victim's browser session.
## Exploitation
- **Status:** Not reported as exploited in the wild; PoC status not explicitly disclosed (likely private reporting by Fabio Zuber).
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
- **User Interaction:** Required (Victim must load a crafted URL and hover over the map pin).
## Impact
- **Confidentiality:** High (Session hijacking, data theft within browser context).
- **Integrity:** Low (Ability to modify the appearance of the page or perform unauthorized actions).
- **Availability:** None reported.
## Remediation
### Patches
Siemens recommends updating the `@siemens/maps-ng` package to the following versions or later:
- **V47.12.3**
- **V48.11.3**
- **V49.16.1**
Update via NPM: `https[:]//www[.]npmjs[.]com/package/@siemens/maps-ng`
### Workarounds
If immediate patching is not possible, the following mitigations should be implemented:
- Deploy a **strict Content Security Policy (CSP)** to restrict script execution.
- Enable **Trusted Types** enforcement.
- Follow **Angular security best practices** for preventing XSS.
## Detection
- **Indicators of Compromise:** Unusual scripts or unexpected behavior when interacting with map pins; suspicious strings (e.g., `<script>`, `onerror`, `onload`) within URL parameters related to map pin properties.
- **Detection Methods:**
- Review web server access logs for suspicious activity.
- Utilize Static Application Security Testing (SAST) tools to identify un-sanitized usage of the `points` property in the `si-map` component.
## References
- **Vendor Advisory:** `https[:]//cert-portal[.]siemens[.]com/productcert/html/ssa-682041[.]html`
- **General Recommendations:** `https[:]//www[.]siemens[.]com/cert/operational-guidelines-industrial-security`
- **ProductCERT Advisories:** `https[:]//www[.]siemens[.]com/cert/advisories`