CVE-2026-63354 is a critical (CVSS 9.6) flaw in many Siemens SIMATIC controllers. A crafted CSV trace file can run attacker-controlled JavaScript in an authorized user's browser and carry out PLC operations through the device's web server.
What Is It
Affected devices do not properly validate or sanitize visual marker data in imported CSV trace files before they show it on the web server's Trace page. An attacker can trick an authorized user who holds the "Read diagnostics" function right into importing a specially crafted trace file. If the user imports it, the attacker's JavaScript runs in that user's browser session. It can then perform PLC operations through the web server, limited to what the user is authorized to do.
Siemens ProductCERT ([email protected]) reported the issue. NVD published it on 2026-10-13, and its status is still "Received," which means NVD has not yet analyzed it.
Why It Matters
Siemens, the CVE Numbering Authority (CNA), rates this flaw CRITICAL at 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). NVD has not published its own assessment yet. The vector shows:
- The attack works over the network and is not complex.
- The attacker needs no privileges, but a user has to take an action (import the file).
- The scope is changed, so the impact reaches beyond the vulnerable component.
- Confidentiality, integrity and availability impacts are all high.
The payload runs inside a legitimate user's session, so the attacker can act on the PLC with that user's permissions. In an industrial control setting, a social-engineering lure could therefore lead to changes in physical processes.
The CVE does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, so this data does not confirm active exploitation.
What's Vulnerable
The CVE record lists these Siemens products as affected. Each version range starts at "0" with no fixed upper bound:
- SIMATIC Drive Controller CPU 1504D TF and CPU 1507D TF
- SIMATIC ET 200SP CPU 1510SP-1 PN and 1510SP F-1 PN
- SIMATIC ET 200SP CPU 1512SP-1 PN and 1512SP F-1 PN
- SIMATIC ET 200SP CPU 1514SP-2 PN and 1514SP F-2 PN
- SIMATIC ET 200SP CPU 1514SPT-2 PN and 1514SPT F-2 PN
- SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)
- SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants): V2 CPUs on Windows OS, and V3 CPUs on Industrial OS and Windows OS
- SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 CPUs
- SIMATIC S7-1500 CPU 1511-1 PN
The record we received is cut off partway through the S7-1500 entries, so more models are probably affected. Check Siemens advisory SSA-591731 for the full list.
Patch Status
The record we received gives no fixed version, and every affected range is open-ended. The CVE is not in the CISA KEV catalog, so CISA has not set a required action or due date. Asset owners should check Siemens advisory SSA-591731 for fixed firmware and vendor mitigations. Only users with the "Read diagnostics" right can trigger this flaw, and only by importing a trace file. Until a fix is in place, those users should not import trace files from untrusted sources.
Sources
- Siemens ProductCERT, SSA-591731: https://cert-portal.siemens.com/productcert/html/ssa-591731.html
- NVD, CVE-2026-63354: https://nvd.nist.gov/vuln/detail/CVE-2026-63354
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog