CVE-2026-63357: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Siemens SIMATIC Drive Controller CPU 1504D TF

Siemens SIMATIC Drive Controller CPU 1504D TF improperly neutralizes input during web page generation, specifically failing to sanitize calculated signal data from imported calculated signal files before rendering on the Trace page. This cross-site scripting vulnerability (CWE-79) could be exploited by social engineering an authorized user with 'Read diagnostics' rights to import a crafted file. Successful exploitation enables attacker-controlled JavaScript execution in the user's browser session, potentially allowing PLC operations through the web server within the user's authorization scope.

Successful exploitation allows execution of attacker-controlled JavaScript in the context of an authorized user's browser session. This could lead to unauthorized PLC operations performed through the web server, constrained by the user's existing permissions. The vulnerability does not require elevated privileges but does require user interaction (importing a malicious file). There is no indication of impact on confidentiality beyond limited data exposure, and no denial of service impact is noted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid importing calculated signal files from untrusted sources and ensure that only trusted personnel with appropriate rights perform such imports. Monitoring for suspicious activity related to file imports and user sessions is advisable.