EUVD Vulnerability Catalog

EUVD-2026-98384

Severity: CRITICAL Base Score: 9.4 CVSS Version: 4.0

Vulnerability Description

Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

▪ Attack Vector (AV): Network

▪ Attack Complexity (AC): Low

▪ Attack Requirements (AT): None

▪ Privileges Required (PR): None

▪ User Interaction (UI): Active

▪ Vulnerability Confidentiality Impact (VC): High

▪ Vulnerability Integrity Impact (VI): High

▪ Vulnerability Availability Impact (VA): High

▪ Subsequent Confidentiality Impact (SC): High

▪ Subsequent Integrity Impact (SI): High

▪ Subsequent Availability Impact (SA): High

Affected Vendors & Systems

Vendor Siemens

References & Advisory Links

https://cert-portal.siemens.com/productcert/html/ssa-591731.html

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

siemens

EPSS Probability

Known Aliases

CVE-2026-63353

Published On

2026-10-13

Last Updated

2026-10-13