{"id":"CVE-2026-63353","published":"2026-10-13T10:17:18.040","lastModified":"2026-10-15T20:38:04.303","description":"Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page.\r\n\r\nThis could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-591731.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A web application fails to sanitize comment fields in imported trace files, allowing attackers to inject malicious JavaScript that executes in users' browsers when they view diagnostic traces. This creates a critical cross-site scripting vulnerability that can be exploited through social engineering to perform PLC operations with user privileges.","exploitability":"Exploitation requires social engineering an authorized user with 'Read diagnostics' rights to import a crafted trace file, making it moderately difficult but achievable with targeted phishing efforts.","blast_radius":"If exploited, attackers could execute arbitrary JavaScript in users' browser sessions to perform PLC operations within the scope of user authorization, potentially leading to industrial control system compromise and operational disruption.","remediation":"Disable the trace file import functionality until a fixed version is available, or restrict access to the Trace page to administrators only.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","ics","web","social-engineering"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:53:52.646Z"}}