EXPOSURES › CVE-2026-63353
CVE-2026-63353
CRITICALAn unpatched flaw in industrial devices allows social engineering of authorized users into importing malicious trace files, leading to remote code execution and PLC operations.
Affected industrial devices fail to sanitize comment fields in imported trace files, enabling attackers to social engineer authorized users with 'Read diagnostics' rights into executing attacker-controlled JavaScript. This results in remote code execution and unauthorized PLC operations within the user's authorization scope, posing a severe supply-chain and ICS-OT risk to DIB organizations relying on these devices.
Shame score — The failure to properly sanitize imported data is a negligent, avoidable oversight that directly enables remote code execution and industrial control system manipulation, representing a high-impact, reputation-shredding vulnerability.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.