Direct naar de inhoud
⚡ Kritieke cyberalerts voor jouw sector & systemen — direct in je inbox. Aanmelden →
cybernieuws.nl Cybersecurity en informatiebeveiling nieuws alerts live · net nu 171 bronnen 2 kritiek 35 vandaag
CVE's Videos Dagbriefing

← Terug naar CVE-database

CVE-2026-63354

CRITICAL · 9.6 CVSS Gepubliceerd: CWE-79

Beschrijving NL

Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.

Origineel (Engels) tonen

Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page.

This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.

References