CVE-2026-63353

Summary

A web application fails to sanitize comment fields in imported trace files, allowing attackers to inject malicious JavaScript that executes in users' browsers when they view diagnostic traces. This creates a critical cross-site scripting vulnerability that can be exploited through social engineering to perform PLC operations with user privileges.

Exploitability

Exploitation requires social engineering an authorized user with 'Read diagnostics' rights to import a crafted trace file, making it moderately difficult but achievable with targeted phishing efforts.

Blast radius

If exploited, attackers could execute arbitrary JavaScript in users' browser sessions to perform PLC operations within the scope of user authorization, potentially leading to industrial control system compromise and operational disruption.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the trace file import functionality until a fixed version is available, or restrict access to the Trace page to administrators only.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.