CVE-2026-63357
6.1MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Attackers can execute malicious JavaScript in an authorized user's browser session and perform PLC web operations under their privileges. This requires social engineering an authorized user with 'Read diagnostics' rights into importing a malicious calculated signal file.
Root cause
The Trace page fails to sanitize calculated signal data from imported files before rendering it, resulting in cross-site scripting (XSS).
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Fix & remediation
Check the Siemens advisory (SSA-591731) for updated PLC firmware versions. In the interim, restrict access to the PLC web server and instruct authorized operators never to import untrusted calculated signal files.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.