CVE-2026-63350: CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in Siemens SIMATIC Drive Controller CPU 1504D TF

The vulnerability arises from improper neutralization of directives in dynamically evaluated code (CWE-95) in Siemens SIMATIC Drive Controller CPU 1504D TF. Specifically, the device fails to restrict executable content in imported trace files, allowing attacker-controlled JavaScript to execute in the context of an authorized user's browser session. Exploitation requires social engineering to have an authorized user import a crafted trace file. Successful exploitation could lead to execution of arbitrary PLC operations via the web server under the user's privileges.

Exploitation could lead to full compromise of PLC operations within the authorization scope of the targeted user, potentially affecting confidentiality, integrity, and availability of the industrial control system. The CVSS 3.1 score is 9.6 (critical), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until a fix is available, users should avoid importing trace files from untrusted sources and limit the 'Read diagnostics' function rights to trusted personnel only.