{"id":"CVE-2026-63350","published":"2026-10-13T10:17:16.777","lastModified":"2026-10-15T20:38:04.303","description":"Affected devices do not properly restrict executable content contained in imported trace files.\r\n\r\nThis could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-95"],"vendors":[],"products":[],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-591731.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to execute arbitrary JavaScript in a user's browser session by tricking them into importing a malicious trace file. Since users with 'Read diagnostics' rights can import these files, an attacker can leverage social engineering to gain access to PLC operations within the scope of that user's authorization.","exploitability":"Exploitation requires social engineering to convince a user with 'Read diagnostics' rights to import a crafted trace file, making it moderately difficult but achievable with a well-crafted phishing campaign.","blast_radius":"If exploited, attackers could perform PLC operations on industrial control systems through the web server, potentially leading to significant operational disruptions or unauthorized access to critical infrastructure.","remediation":"Disable the trace file import functionality for users without administrative privileges until a patch is available.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["ics","web","javascript","social-engineering"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:53:45.561Z"}}