CVE-2026-63354: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Siemens SIMATIC Drive Controller CPU 1504D TF

CVE-2026-63354 is a cross-site scripting vulnerability (CWE-79) in Siemens SIMATIC Drive Controller CPU 1504D TF. The affected devices do not properly validate or sanitize visual marker data in imported CSV trace files before rendering it on the Trace page. An attacker can exploit this by social engineering an authorized user with the 'Read diagnostics' function right to import a specially crafted trace file. Successful exploitation results in attacker-controlled JavaScript executing in the user's browser session, enabling unauthorized PLC operations within the user's authorization scope.

Successful exploitation allows execution of arbitrary JavaScript in the context of an authorized user's browser session, potentially enabling the attacker to perform PLC operations through the web server with the same privileges as the user. This can lead to full compromise of the affected device's control functions, impacting confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the import of CSV trace files to trusted sources and limit the 'Read diagnostics' function right to highly trusted users only. Monitor Siemens advisories for updates and patches addressing this vulnerability.