Siemens Drive Controllers Face Critical Cross-Site Scripting Flaw in CSV Import

Siemens SIMATIC industrial hardware contains a critical cross-site scripting vulnerability that could allow remote attackers to execute arbitrary code. The flaw, tracked as CVE-2026-63354, stems from improper validation of visual marker data within imported CSV trace files.

According to the National Vulnerability Database, the issue allows an attacker to inject malicious JavaScript into the Trace page rendering process. This happens because affected devices do not properly sanitize the data before displaying it.

Technical Context and Impact

The vulnerability is classified with a CVSS v3.1 score of 9.6, which places it in the critical severity range. The underlying weakness is identified as CWE-79, which relates to improper neutralization of input during web page generation.

An attacker must first social engineer an authorized user into importing a specially crafted trace file. The user must hold the specific function right known as “Read diagnostics” for the attack to succeed.

Once the malicious file is imported, attacker-controlled JavaScript executes within the victim’s browser session. This code can then perform Programmable Logic Controller (PLC) operations through the web server. The actions performed are limited to the scope of the user’s authorization.

Affected Hardware Models

Several specific Siemens SIMATIC components are affected by this vulnerability. The list includes Drive Controller CPU models and ET 200SP CPU models.

Affected Drive Controller units include the Siemens SIMATIC Drive Controller CPU 1504D TF. The Siemens SIMATIC Drive Controller CPU 1507D TF is also listed as vulnerable.

The ET 200SP series includes multiple vulnerable configurations. The Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN is affected. The Siemens SIMATIC ET 200SP CPU 1510SP-1 PN is also listed.

The source material lists these ET 200SP models twice with slight variations in naming conventions. Both the F-1 PN and the -1 PN variants are included in the affected list.

No specific version numbers are provided for the affected products. The records indicate that versions prior to an unspecified update are vulnerable.

What should you do?

Security teams should immediately audit their environments for the presence of affected Siemens hardware. Identify any systems running the listed Drive Controller or ET 200SP CPU models.

Review access controls for the “Read diagnostics” function right. Limit this permission to only those users who strictly require it for operational tasks.

Monitor network traffic for unusual patterns originating from web servers associated with these controllers. Look for unexpected PLC operations initiated through browser sessions.

Until a confirmed fix is available, restrict the ability to import CSV trace files. Implement strict file validation on endpoints before allowing users to process diagnostic data.