CVE-2026-63352: XSS
Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authorized users who have the “Read diagnostics” function right are exposed if they import an attacker-crafted CSV trace file and view it on the Trace page. The attacker must rely on social engineering to get that user to perform the import.
What could an attacker do after successful exploitation?
Attacker-controlled JavaScript can run in the authorized user’s browser session. It may perform PLC operations through the web server, limited to the permissions held by that user.
Does exploitation require prior authentication or user interaction?
The attacker does not need privileges, but exploitation requires user interaction. A user with the “Read diagnostics” right must import the specially crafted CSV trace file.