Siemens Drive Controllers Have Critical Cross-Site Scripting Flaw
A critical vulnerability in Siemens industrial controllers allows attackers to execute JavaScript via crafted trace files, risking PLC operations.
Key points
- CVE-2026-63353 is rated CVSS 9.6 Critical by the National Vulnerability Database.
- The flaw involves improper sanitization of comment fields in imported trace files.
- Exploitation requires social engineering an authorized user with Read diagnostics rights.
Siemens SIMATIC Drive Controllers and ET 200SP CPUs contain a critical cross-site scripting vulnerability that could allow attackers to execute malicious JavaScript in a user’s browser. The National Vulnerability Database assigned the issue CVE-2026-63353 with a CVSS score of 9.6, classifying it as critical severity. This flaw affects multiple processor models within Siemens’ industrial automation portfolio.
At a glance
- CVE
- CVE-2026-63353
- Product
- Siemens SIMATIC Drive Controller CPU 1504D TF
- CVSS
- 9.6 Critical
- Weakness
- cross-site scripting
- Exploited
- No known exploitation
The vulnerability stems from the device’s failure to properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. According to the NVD record, this lack of input validation creates an opening for stored cross-site scripting, identified under CWE-79. An attacker can embed malicious code within these comment fields, which then executes when the file is viewed.
Context and Background
Successful exploitation of this flaw relies on social engineering an authorized user who holds the specific function right “Read diagnostics.” The attacker must convince this user to import a specially crafted trace file into the affected device. Once the file is imported, the attacker-controlled JavaScript executes within the user’s browser session. This execution occurs within the scope of the user’s authorization, potentially allowing the attacker to perform Programmable Logic Controller operations through the web server.
Who Is Affected
Multiple Siemens hardware models are affected by this vulnerability. The NVD record lists Siemens SIMATIC Drive Controller CPU 1504D TF and CPU 1507D TF as affected devices. Additionally, several Siemens SIMATIC ET 200SP CPU models are vulnerable, including the CPU 1510SP F-1 PN and CPU 1510SP-1 PN. The record indicates that versions prior to an unspecified update are at risk for all listed models. No specific version number or patch date is provided in the source material to indicate when the fix becomes available.
What should you do?
Security teams should verify if their environments contain any of the listed Siemens controller models. Users with the “Read diagnostics” function right should be educated about the risks of importing untrusted trace files. Organizations should restrict access to the Trace page and monitor for unauthorized JavaScript execution or unusual PLC operations. Until a vendor-provided update is confirmed, limiting import capabilities may reduce exposure.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: Siemens
- Audit your inventory to identify any Siemens SIMATIC Drive Controller or ET 200SP CPU models listed in the NVD record.
- Restrict the “Read diagnostics” function right to only those employees who strictly require it for daily operations.
- Implement strict validation rules for any trace files imported into industrial control systems to prevent malicious content.
- Monitor web server logs and browser sessions for unexpected JavaScript execution or anomalous PLC commands.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-63353?
The National Vulnerability Database rates CVE-2026-63353 with a CVSS score of 9.6, which is classified as Critical.
Which Siemens devices are affected by this vulnerability?
Affected devices include Siemens SIMATIC Drive Controller CPUs 1504D TF and 1507D TF, as well as several ET 200SP CPU 1510SP models.
Is a patch available for this flaw?
The source material does not confirm that a patch or fix has been released yet; it only lists affected versions before an unspecified update.
