EXPOSURES › CVE-2026-63354
CVE-2026-63354
CRITICALAn unpatched flaw in industrial devices allows social engineering of authorized users into importing malicious CSV trace files, leading to remote code execution and PLC operations.
Affected devices fail to validate and sanitize visual marker data in imported CSV trace files, enabling an attacker to social engineer an authorized user with 'Read diagnostics' rights into executing attacker-controlled JavaScript and performing PLC operations. DIB organizations must ensure industrial control systems are patched against known vulnerabilities and restrict file import capabilities to prevent supply-chain-style attacks via seemingly benign data files.
Shame score — The failure to properly validate and sanitize imported data represents a negligent, avoidable vulnerability that allows remote code execution and industrial control operations, severely impacting operational security and compliance.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.