VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2026/27xxx/CVE-2026-27867.json
T

269 lines
11 KiB
JSON
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-27867",
"assignerOrgId": "ffb98d57-deaa-4918-a669-5225ccc13e39",
"state": "PUBLISHED",
"assignerShortName": "HackRTU",
"dateReserved": "2026-02-24T08:59:28.139Z",
"datePublished": "2026-09-25T10:32:58.916Z",
"dateUpdated": "2026-09-25T10:43:05.972Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "ffb98d57-deaa-4918-a669-5225ccc13e39",
"shortName": "HackRTU",
"dateUpdated": "2026-09-25T10:32:58.916Z"
},
"title": "CROSS-SITE SCRIPTING (XSS) VIA THE CMDCOOKIE PARAMETER REGESTA SMART HD-PLC OF TELDAT",
"datePublic": "2026-09-25T08:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
},
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"affected": [
{
"vendor": "Teldat",
"product": "Regesta Smart HD-PLC - TLDPH16D2",
"versions": [
{
"status": "affected",
"version": "11.02.06.00.02"
},
{
"status": "unaffected",
"version": "11.02.06.00.03"
}
],
"defaultStatus": "unknown"
}
],
"cpeApplicability": [
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:teldat:regesta_smart_hd-plc_-_tldph16d2:11.02.06.00.02:*:*:*:*:*:*:*"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:a:teldat:regesta_smart_hd-plc_-_tldph16d2:11.02.06.00.03:*:*:*:*:*:*:*"
}
]
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action is required) who has the vulnerable firmware version could inject\na specific payload via the parameter \"cmdcookie\" withing the /upgrade/index.html resulting in to a Cross-Site Scripting (XSS). This issue affects Regesta Smart HD-PLC - TLDPH16D2: \n11.02.06.00.02",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action is required) who has the vulnerable firmware version could inject\na specific payload&nbsp;via the parameter \"cmdcookie\" withing the<i> /upgrade/index.html</i> resulting in to a Cross-Site Scripting (XSS).&nbsp;This issue affects Regesta Smart HD-PLC - TLDPH16D2:&nbsp;\n11.02.06.00.02"
}
]
}
],
"references": [
{
"url": "https://www.hackrtu.com/blog/CNA-HRTU-0004/",
"tags": [
"patch",
"technical-description"
]
},
{
"url": "https://www.hackrtu.com/blog/CNA-CVE-2026-27867/",
"tags": [
"patch",
"technical-description"
]
},
{
"url": "https://www.teldat.com/es/",
"tags": [
"product"
]
},
{
"url": "https://support.teldat.com/images/content/docs/Teldat_dm1087_regesta_smart_nessum_series_installation(1).pdf",
"tags": [
"product"
]
},
{
"url": "https://support.teldat.com/portal/supportcontent?page=cgs-customer-global-support&none=true&language=en-US",
"tags": [
"patch"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 4.8,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
}
}
],
"solutions": [
{
"lang": "en",
"value": "The\nprovider has implemented the new version 11.02.06.00.03 which solves the\nsecurity problems detected in the affected version. The end user has to\ndownload the new version in the Teldat - Client Support Portal and\nimplement it in the device ( https://support.teldat.com/portal/supportcontent?page=cgs-customer-global-support&none=true&language=en-US ).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>The\nprovider has implemented the new version <b>11.02.06.00.03 </b>which solves the\nsecurity problems detected in the affected version. The end user has to\ndownload the new version in the <b>Teldat - Client Support Portal</b> and\nimplement it in the device (<a href=\"https://support.teldat.com/portal/supportcontent?page=cgs-customer-global-support&amp;none=true&amp;language=en-US\">https://support.teldat.com/portal/supportcontent?page=cgs-customer-global-support&amp;none=true&amp;language=en-US</a>).</p>"
}
]
}
],
"timeline": [
{
"time": "2026-07-10T08:00:00.000Z",
"lang": "en",
"value": "Vulnerability detection by the researchers"
},
{
"time": "2026-07-16T08:00:00.000Z",
"lang": "en",
"value": "Report from researchers to the CNA of HackRTU"
},
{
"time": "2026-07-16T08:00:00.000Z",
"lang": "en",
"value": "Report from HackRTU CNA to the provider"
},
{
"time": "2026-07-21T08:00:00.000Z",
"lang": "en",
"value": "Second report from HackRTU CNA to the provider"
},
{
"time": "2026-09-25T08:00:00.000Z",
"lang": "en",
"value": "Vulnerabilities published by HackRTU's CNA"
}
],
"credits": [
{
"lang": "en",
"value": "Aarón Flecha Menéndez",
"type": "finder"
},
{
"lang": "en",
"value": "Víctor Bello Cuevas",
"type": "finder"
}
],
"source": {
"advisory": "HRTU#0004",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-09-25T10:42:56.136783Z",
"id": "CVE-2026-27867",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-09-25T10:43:05.972Z"
}
}
]
}
}
View Git Blame Copy Permalink