CVE-2026-63352
6.1MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Attackers can run malicious JavaScript in an authorized user's session to execute unauthorized PLC operations via the web interface. To exploit this, an attacker must trick an engineer with 'Read diagnostics' rights into importing a crafted CSV trace file.
Root cause
The web interface Trace page fails to sanitize calculated signal data from imported CSV files before rendering it.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Fix & remediation
Consult Siemens advisory ssa-591731 for device-specific firmware updates; in the interim, instruct engineers not to import untrusted CSV trace files into the PLC web server.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.