CVE-2026-63357: XSS
Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who have the “Read diagnostics” function right and can be persuaded to import a specially crafted calculated signal file are exposed. The attacker-controlled JavaScript executes in that user's browser session.
What does an attacker need to exploit the vulnerability?
An attacker needs to craft a malicious calculated signal file and socially engineer an authorized user into importing it. No attacker privileges are required, but user interaction is required.
What could an attacker do after successful exploitation?
The attacker-controlled JavaScript can perform PLC operations through the web server, limited to the authorization scope of the affected user's session.