CVE-2026-63351: XSS
Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users with the “Read diagnostics” function right are exposed if they import a specially crafted CSV trace file and view it on the Trace page. Exploitation runs attacker-controlled JavaScript in that user’s browser session.
What does an attacker need to exploit it?
An attacker needs to create a malicious CSV trace file and socially engineer an authorized user into importing it. No attacker authentication is indicated, but user interaction is required.
What could an attacker do after successful exploitation?
The attacker-controlled script can perform PLC operations through the web server using the permissions of the affected user. The impact is limited to the scope of that user’s authorization.