CVE-2026-25599
Stored XSS in Orca Heat Pump Web Interface
Publication date: 2026-06-01
Last updated on: 2026-06-01
Assigner: ENISA
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| orca | heat_pump | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-319 | The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. |
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability involves missing authentication and clear-text transmission of data, which can lead to unauthorized access and theft of sensitive information such as cookies from the pump’s web control interface.
Such security weaknesses could potentially result in non-compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data through proper authentication, encryption, and input validation.
Specifically, the exposure of sensitive information and the possibility of unauthorized actions within the user portal may violate data protection requirements and increase the risk of data breaches.
Can you explain this vulnerability to me?
This vulnerability involves missing authentication and clear-text transmission of data between Orca heat pumps and their control server. Because the communication happens over an unencrypted and unauthenticated HTTP connection, an attacker can impersonate a legitimate device.
Additionally, the absence of input validation on aggregated data allows for stored cross-site scripting (XSS) attacks. This means an attacker can inject malicious code into the Orca user portal, which can then be used to steal cookies from the pump’s web control interface.
Overall, this vulnerability enables attackers to compromise user accounts, expose sensitive information, and perform unauthorized actions within the portal.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing attackers to impersonate legitimate heat pump devices and inject harmful code into the user portal.
This can lead to theft of cookies, which may result in unauthorized access to user accounts.
Consequently, sensitive information could be exposed and attackers could perform further unauthorized actions within the portal, potentially compromising the security and integrity of your heat pump system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves identifying unencrypted and unauthenticated HTTP communication between Orca heat pump devices and the Orca control server, especially on non-secure ports.
Network monitoring tools can be used to capture traffic and check for HTTP connections from Orca heat pumps. Commands such as 'tcpdump' or 'Wireshark' filters can help detect this traffic.
- Use tcpdump to capture HTTP traffic on the suspected port: tcpdump -i <interface> tcp port <port_number> and inspect for unencrypted data.
- Use curl or wget to attempt connecting to the Orca heat pump device or server over HTTP and check if authentication is required.
- Check web control interfaces for signs of stored XSS by inspecting cookies and input fields for malicious payloads.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling unencrypted HTTP communication between Orca heat pumps and the control server.
Ensure that communication is encrypted and authenticated, preferably by switching to HTTPS or another secure protocol.
Apply input validation on all aggregated data to prevent stored XSS attacks.
Restrict access to the Orca user portal and monitor for suspicious activity that could indicate exploitation attempts.