CVE-2026-63354: XSS
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users with the “Read diagnostics” function right are exposed if they can be persuaded to import a specially crafted CSV trace file and then render its visual marker data on the Trace page.
What must an attacker do to exploit it?
The attacker must socially engineer an authorized user into importing a malicious CSV trace file. Exploitation requires user interaction, but does not require the attacker to be authenticated.
What could successful exploitation allow?
Attacker-controlled JavaScript can execute in the authorized user’s browser session. It may perform PLC operations through the web server with the permissions available to that user.
How should access be managed while evaluating remediation?
Limit the “Read diagnostics” function right to users who need it, and instruct those users not to import trace CSV files from untrusted sources. Treat externally supplied trace files as potentially malicious.