CVE-2026-63355
6.1MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Attackers can run arbitrary JavaScript in an authorized user's browser session. To succeed, the attacker must convince a user with 'Read diagnostics' permissions to import a malicious CSV trace file and interact with the affected menu.
Root cause
The application fails to sanitize signal names imported from CSV trace files before rendering them in Trace page selection menus, resulting in stored cross-site scripting.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Fix & remediation
Review Siemens advisory SSA-591731 for device firmware updates. As an interim workaround, instruct users with diagnostic rights not to import untrusted CSV trace files.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user’s browser session when the user subsequently interacts with an affected selection menu.