CVE-2026-63350

Summary

This vulnerability allows attackers to execute arbitrary JavaScript in a user's browser session by tricking them into importing a malicious trace file. Since users with 'Read diagnostics' rights can import these files, an attacker can leverage social engineering to gain access to PLC operations within the scope of that user's authorization.

Exploitability

Exploitation requires social engineering to convince a user with 'Read diagnostics' rights to import a crafted trace file, making it moderately difficult but achievable with a well-crafted phishing campaign.

Blast radius

If exploited, attackers could perform PLC operations on industrial control systems through the web server, potentially leading to significant operational disruptions or unauthorized access to critical infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the trace file import functionality for users without administrative privileges until a patch is available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.