CVE-2026-63353: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Siemens SIMATIC Drive Controller CPU 1504D TF

Siemens SIMATIC Drive Controller CPU 1504D TF contains a CWE-79 improper input neutralization vulnerability. The product fails to sanitize comment fields in imported trace files before rendering them on the Trace page. An attacker can exploit this by social engineering an authorized user to import a malicious trace file, leading to execution of arbitrary JavaScript in the user's browser session. This script can perform PLC operations through the web server with the user's privileges. The vulnerability has a CVSS 3.1 score of 9.6, indicating critical severity.

Successful exploitation allows attacker-controlled JavaScript to run in the context of an authorized user's browser session, potentially enabling the attacker to perform programmable logic controller (PLC) operations through the web server with the same authorization as the user. This can lead to full confidentiality, integrity, and availability compromise of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid importing trace files from untrusted sources and restrict the 'Read diagnostics' function right to trusted users only.