CVE-2026-63353

Siemens devices fail to sanitize comment fields in imported trace files before showing them on the Trace page, which is a cross-site scripting flaw (CWE-79). An attacker must persuade an authorized user who has the “Read diagnostics” right to import a crafted trace file. Script then runs in that user’s browser session and can drive PLC operations through the web server only within that user’s existing authorization. The issue is rated CVSS 4.0 9.4 because impact on the device and on subsequent PLC actions is high, but it requires the victim to import the file. It is not on the CISA KEV list, and no public proof-of-concept is known.

What to do: Do not import trace files from untrusted sources, and limit the “Read diagnostics” right to users who need it. Treat the Trace page as untrusted content until Siemens ProductCERT publishes the affected product list and a fix, then apply that update. If a suspicious trace was imported, end that user’s web session and review PLC changes made under their account.