CVE-2026-27867
Received Received - Intake

Reflected XSS in Regesta Smart HD-PLC Firmware

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: HackRTU

Description
An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action is required) who has the vulnerable firmware version could inject a specific payload via the parameter "cmdcookie" withing the /upgrade/index.html resulting in to a Cross-Site Scripting (XSS). This issue affects Regesta Smart HD-PLC - TLDPH16D2:  11.02.06.00.02

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-27867
EUVD
EUVD-2026-86931

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
teldat regesta_smart_hd-plc 11.02.06.00.02

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Scripting (XSS) flaw in the Regesta Smart HD-PLC device by Teldat. An attacker with network access and the vulnerable firmware version (11.02.06.00.02) can inject a malicious payload via the 'cmdcookie' parameter in the /upgrade/index.html page. This could allow execution of arbitrary scripts in the context of the user's browser.

Detection Guidance

To detect this vulnerability, inspect network traffic for requests to /upgrade/index.html with the cmdcookie parameter. Check firmware versions of Regesta Smart HD-PLC devices for 11.02.06.00.02. Use tools like Wireshark to capture and analyze HTTP requests containing cmdcookie.

Impact Analysis

An attacker could exploit this to steal session cookies, perform actions on behalf of the user, or redirect to malicious sites. This may lead to unauthorized access to sensitive data or account compromise if the user is logged into the device interface.

Compliance Impact

This XSS vulnerability could expose personal or sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) if exploited. It may lead to unauthorized data access, impacting compliance with these regulations.

Mitigation Strategies

Immediately update the firmware of Regesta Smart HD-PLC devices to a non-vulnerable version. Restrict network access to the device's web interface. Monitor for suspicious cmdcookie parameter usage in HTTP requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-27867. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart