Skip to content
NewA calmer, faster ZeroHour
Vulnerability1

CVE-2026-63350

JavaScript injection via imported trace files in Siemens devices

CVSS 4.0
9.4 critical
EPSS
—
Published
·
Modified
Analyze CVE-2026-63350 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

CVE-2026-63350 is a critical flaw (CVSS 4.0 base score 9.4, CWE-95) in which affected Siemens devices do not properly restrict executable content inside imported trace files. An attacker can socially engineer an authorized user who holds the “Read diagnostics” function right into importing a specially crafted trace file. Attacker-controlled JavaScript then runs in that user’s browser session and can perform PLC operations through the device web server, within the scope of the user’s existing authorization, with high impact on confidentiality, integrity, and availability. The provided data does not name specific models or version ranges. It is not in the CISA Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

What to do: Do not import trace files from untrusted sources, and limit the “Read diagnostics” right to trusted users. Apply the Siemens ProductCERT update for CVE-2026-63350 when it is available for your device, and keep PLC diagnostic web interfaces off untrusted networks.

ProductAffected
Siemens—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.

Weakness
CWE-95
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD CVE.org GitHub PoCs EPSS (—)

In the news

1 story