CVE-2026-63353: XSS
Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authorized users who have the “Read diagnostics” function right and use the Trace page are exposed if they import a maliciously crafted trace file. The impact of any resulting browser-session actions is limited to the authorization scope of that user.
What does an attacker need to exploit it?
An attacker needs to persuade a user with the “Read diagnostics” right to import a specially crafted trace file. Exploitation requires user interaction; the attacker-controlled JavaScript runs in the authorized user’s browser session after the imported comments are rendered.
What could successful exploitation allow?
It could allow attacker-controlled JavaScript to execute in the user’s browser session. That script may perform PLC operations through the web server using the affected user’s authorization.