Trace page vulnerabilities

Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. An attacker can socially engineer an authorized user with the 'Read diagnostics' right into importing a crafted trace file.

Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. An attacker can socially engineer an authorized user with the 'Read diagnostics' right into importing a crafted trace file.

Affected devices do not properly restrict executable content contained in imported trace files. An attacker can socially engineer an authorized user with the 'Read diagnostics' right into importing a crafted trace file.