# Siemens gWAP RCE via Axios prototype pollution

Published: 2026-05-14 · Severity: elevated · Sectors: manufacturing
Canonical: https://vorant.io/reports/fb77b8f3-f6ad-5318-a8b5-b1f91b18c509/siemens-gwap-rce-via-axios-prototype-pollution

> Prototype pollution in Axios HTTP client allows remote code execution in Siemens gWAP versions below 3.1.1.

Siemens gPROMS Web Applications Publisher (gWAP) is affected by a remote code execution vulnerability introduced through a vulnerable version of the Axios HTTP client library. The vulnerability stems from a prototype pollution attack chain in Axios that can be escalated to arbitrary code execution or full cloud compromise via AWS IMDSv2 bypass. The issue affects gWAP versions prior to 3.1.1 and is tracked as CVE-2026-40175. Siemens has released version 3.1.1 as a remediation.

The vulnerability exists in Axios versions prior to 1.15.0 and 0.3.1, where a specific gadget attack chain allows attackers to exploit prototype pollution in third-party dependencies bundled with gWAP. Defenders should update to gWAP version 3.1.1 or later immediately. Organizations should also apply defense-in-depth strategies including network segmentation, firewall protection, and restriction of internet-facing access to gWAP instances.

## Mentioned in this report

- Vulnerabilities: CVE-2026-40175

## Detection guidance (public sample)

### Prototype Pollution Payload in Web Request URI

ATT&CK: T1190

Detects HTTP requests carrying prototype pollution keys (__proto__, constructor.prototype) in the URI, the entry step of Axios gadget chains such as CVE-2026-40175. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Prototype Pollution Payload in Web Request URI
description: Detects web requests whose URI or query string contains prototype pollution
  keys such as __proto__ or constructor[prototype], including URL-encoded forms. This
  is the entry step of gadget chains in Node.js libraries like Axios (CVE-2026-40175
  in Siemens gWAP).
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_plain:
    cs-uri-query|contains:
    - __proto__
    - constructor[prototype]
    - constructor.prototype
    - '[__proto__]'
  selection_encoded:
    cs-uri-query|contains:
    - '%5f%5fproto%5f%5f'
    - constructor%5bprototype%5d
  selection_stem:
    cs-uri-stem|contains:
    - __proto__
    - '%5f%5fproto%5f%5f'
  condition: 1 of selection_*
falsepositives:
- Security scanners or penetration tests sending prototype pollution probes
- Developer tooling that passes JavaScript object paths in query strings
level: medium
id: 40d3d2b8-a7e1-56f1-89e9-1f34a1764251
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-01
```

### Node.js Process Spawning Shell With Suspicious Commands

ATT&CK: T1203

Detects node.exe spawning a command interpreter or LOLBin with recon or download-style arguments, consistent with code execution after exploitation of a Node.js web application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Node.js Process Spawning Shell With Suspicious Commands
description: Detects node.exe spawning cmd, PowerShell or common download LOLBins
  with reconnaissance or payload-retrieval arguments. Indicates possible RCE in a
  Node.js-based web application, such as one reached via an Axios prototype pollution
  chain.
tags:
- attack.execution
- attack.t1203
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \node.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \mshta.exe
  selection_cmd:
    CommandLine|contains:
    - whoami
    - net user
    - net localgroup
    - 'curl '
    - 'wget '
    - Invoke-WebRequest
    - DownloadString
    - DownloadFile
    - -enc
    - urlcache
    - ipconfig
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Node-based build or deployment scripts that call curl or PowerShell on developer
  or build servers
- Administrative Node.js tooling running diagnostic commands
level: medium
id: c1ab2953-1f61-5887-92e4-6ee3cba07905
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-01
```

### Node.js Process Connecting to Cloud Instance Metadata Service

ATT&CK: T1190

Detects node.exe connecting to the 169.254.169.254 instance metadata endpoint, which may indicate SSRF or IMDSv2 bypass leading to cloud credential theft. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Node.js Process Connecting to Cloud Instance Metadata Service
description: Detects node.exe making network connections to the link-local instance
  metadata address. The Axios prototype pollution chain can be escalated to cloud
  compromise through an AWS IMDSv2 bypass. Baseline legitimate SDK use of IMDS before
  enabling alerting.
tags:
- attack.initial-access
- attack.t1190
- attack.credential-access
- attack.t1552.005
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \node.exe
    DestinationIp: 169.254.169.254
  condition: selection
falsepositives:
- Node.js applications on cloud VMs using the AWS SDK that legitimately fetch instance
  role credentials
- Cloud agents bundled with Node.js that query instance metadata
level: medium
id: cf96250d-459c-596e-9889-7a1ec6ab0c12
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-01
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-01

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/fb77b8f3-f6ad-5318-a8b5-b1f91b18c509/siemens-gwap-rce-via-axios-prototype-pollution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup