中文

// CVE · PUBLISHED 2026-10-13

CVE-2026-63350

Siemens / SIMATIC Drive Controller CPU 1504D TF · Siemens / SIMATIC Drive Controller CPU 1507D TF · Siemens / SIMATIC ET 200SP CPU 1510SP F-1 PN · +27

9.4 · CVSS 4.0Critical

Description

Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.

References

Related CVEs

← CVE Index: search every CVE from the last 30 days

This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.