CVE-2026-63350

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC Drive Controller CPU 1504D TF (affected versions not specified)

Description Devices do not properly restrict executable content within imported trace files. An attacker could social engineer an authorized user with the "Read diagnostics" function right to import a specially crafted trace file. This allows attacker-controlled JavaScript to execute in the user's browser session, enabling the performance of PLC (Programmable Logic Controller) operations via the web server within the scope of the user's authorization.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.