{"id":"CVE-2026-63354","published":"2026-10-13T10:17:18.450","lastModified":"2026-10-16T18:17:59.857","description":"Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page.\r\n\r\nThis could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-591731.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A web-based industrial control system allows attackers to inject malicious JavaScript into CSV trace files, which can then be rendered in users' browsers when they import these files. This cross-site scripting vulnerability could enable attackers to execute arbitrary code in users' browser sessions and perform PLC operations with their authorization.","exploitability":"Exploitation requires social engineering an authorized user with 'Read diagnostics' rights to import a malicious CSV file, making it moderately difficult but achievable through targeted phishing or spear-phishing campaigns.","blast_radius":"If exploited, this vulnerability could allow attackers to perform unauthorized PLC operations and potentially compromise entire industrial control systems through a single compromised user account.","remediation":"Disable CSV import functionality for non-administrative users until a patched version is available, or implement strict CSV file validation and sanitization before rendering trace data in the browser.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","ics","web"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:53:17.711Z"}}