CVE-2026-63350: Critical severity vulnerability
Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users who have the “Read diagnostics” function right and can be persuaded to import a specially crafted trace file are exposed. The attacker-controlled JavaScript executes in that user’s browser session and can perform PLC operations within that user’s authorization scope.
Does exploitation require prior access or user interaction?
No attacker privileges are required, but exploitation requires user interaction. An attacker must social engineer an authorized user into importing a malicious trace file.
What is the likely impact if exploitation succeeds?
Successful exploitation can execute attacker-controlled JavaScript in the authorized user’s browser session. This may enable PLC operations through the web server with the same permissions available to that user.