CVE-2026-63355: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Siemens SIMATIC Drive Controller CPU 1504D TF

CVE-2026-63355 is a cross-site scripting vulnerability (CWE-79) in Siemens SIMATIC Drive Controller CPU 1504D TF. The issue arises because signal names in imported CSV trace files are not properly sanitized before being rendered in selection menus on the Trace page. An attacker can exploit this by tricking an authorized user who has the 'Read diagnostics' permission into importing a specially crafted trace file, leading to execution of malicious JavaScript in the user's browser session.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of the authorized user's browser session, potentially leading to information disclosure or manipulation of the user interface. The impact is limited to users with the 'Read diagnostics' function right and requires user interaction to import the malicious file. There is no indication of direct system compromise or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should restrict the import of trace files to trusted sources and educate authorized users about the risks of importing untrusted files. Monitoring and limiting the 'Read diagnostics' permission to necessary personnel can reduce exposure.