External risk intelligence

Executable Content Import Vulnerability in Diagnostic Trace Files Allows JavaScript Execution

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-63350

The vulnerability involves PLC diagnostics and trace file imports. While these web-based management interfaces exist, they are typically deployed within isolated industrial control networks. Public internet exposure is uncommon for this product role, as these devices are generally protected by internal network controls and are not designed for direct exposure to the public internet.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE involves a vulnerability in certain devices that could allow an attacker to execute malicious code by tricking a user into importing a specially crafted file. If exploited, this could potentially enable unauthorized actions on the device within the user's granted permissions, impacting operational technology environments. The main concern is confirming relevance and exposure within your specific deployment.

Malicious files can run code on devices.
Impacts industrial control systems.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could begin by sending a specially crafted trace file to an authorized user. This user, needing the "Read diagnostics" function, would then import the malicious file. The vulnerability allows this imported file to execute attacker-controlled JavaScript within the user's browser. This could then enable the attacker to perform Programmable Logic Controller (PLC) operations, leveraging the user's existing permissions.

No authentication needed for initial access.
User imports a crafted trace file.
Allows arbitrary JavaScript execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute malicious JavaScript in a user's browser session by convincing them to import a crafted trace file. When supported by the advisory, this could enable the attacker to perform PLC operations within the scope of the authorized user's permissions via the web server.

PLC operations and user session data.
Importing a specially crafted trace file.
Unauthorized PLC operations and data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

System owners, application owners, and network security teams must collaborate to address this critical vulnerability affecting executable content in trace files. The initial step is to identify all instances of the affected technology within the environment, determine their reachability and business criticality, and then assign accountability for remediation planning.

Identify accountable system owners.
Verify external reachability and business impact.
Plan remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the software affected by CVE-2026-63350?

This CVE impacts industrial control devices that use web-based interfaces for managing Programmable Logic Controllers (PLCs). Specifically, it involves the system's ability to import and process diagnostic trace files, which are often used by engineers to troubleshoot performance issues or monitor device logs within operational technology environments.

What is the vulnerability class for this issue?

This vulnerability is classified as improper restriction of executable content (CWE-95). In plain terms, the software fails to safely inspect or neutralize code hidden within imported files. Because the system treats this imported content as trusted, it allows the file to run unauthorized JavaScript directly inside an active browser session.

How does an attacker trigger this vulnerability?

The attack requires social engineering to succeed. An attacker must convince an authorized user—specifically one with 'Read diagnostics' permissions—to manually import a malicious trace file into the web interface. Simply accessing the device’s web server normally will not trigger the bug; the code only executes if the user performs the specific action of importing the crafted file.

Do I need to worry if my device is on an internal network?

According to Halo Surface Signal, this vulnerability is unlikely to be exposed to the public internet because these devices are typically deployed within isolated industrial control networks. While your risk profile may be lower due to internal network controls, the threat remains relevant if an unauthorized actor gains access to your internal environment and targets an authorized user.

What should I do if I am running this technology?

Your first step is to locate all instances of this technology in your environment to understand your current footprint. Work with system and network owners to verify whether these devices are accessible from broader segments of your network. Prioritize identifying who has the 'Read diagnostics' function right, as these users are the primary pathway for this vulnerability.

References

cert-portal.siemens.com/productcert/html/ssa-591731.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.