CVE-2026-63352: siemens simatic drive controller cpu 1504d tf Cross-site Scripting

Vulnerability summary

CVE-2026-63352 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in siemens simatic drive controller cpu 1504d tf. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 13.8% of scored vulnerabilities.

Timeline

1. 13-10-2026
   PublishedVulnerability first disclosed.
2. 14-10-2026
   Last modifiedVulnerability information updated.

Description

Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.