CVE-2026-63354

Summary

A web-based industrial control system allows attackers to inject malicious JavaScript into CSV trace files, which can then be rendered in users' browsers when they import these files. This cross-site scripting vulnerability could enable attackers to execute arbitrary code in users' browser sessions and perform PLC operations with their authorization.

Exploitability

Exploitation requires social engineering an authorized user with 'Read diagnostics' rights to import a malicious CSV file, making it moderately difficult but achievable through targeted phishing or spear-phishing campaigns.

Blast radius

If exploited, this vulnerability could allow attackers to perform unauthorized PLC operations and potentially compromise entire industrial control systems through a single compromised user account.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable CSV import functionality for non-administrative users until a patched version is available, or implement strict CSV file validation and sanitization before rendering trace data in the browser.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.