CVE-2026-63351: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Siemens SIMATIC Drive Controller CPU 1504D TF

The vulnerability in Siemens SIMATIC Drive Controller CPU 1504D TF arises from improper neutralization of input during web page generation (CWE-79). Specifically, visual properties of calculated signals in imported CSV trace files are not properly validated or sanitized before rendering on the Trace page. An attacker can exploit this by social engineering an authorized user to import a specially crafted trace file, leading to execution of attacker-controlled JavaScript in the user's browser session. This script can perform programmable logic controller (PLC) operations through the web server with the user's privileges.

Successful exploitation allows execution of arbitrary JavaScript in the context of an authorized user's browser session, potentially enabling unauthorized PLC operations within the scope of the user's permissions. This could lead to unauthorized control or manipulation of the industrial control system. However, exploitation requires user interaction (importing a malicious file) and the user must have the 'Read diagnostics' function right.

No official patch or remediation information is currently provided. Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until a fix is available, users should avoid importing trace files from untrusted sources and restrict the 'Read diagnostics' function right to trusted personnel only.