Stored XSS in Satel Netco Design

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: ICS-CERT

Description

Satel Netco Design versions prior to v2.1.7 contains a stored cross site scripting vulnerability. An authenticated user with Network Operator privileges could store untrusted content that is rendered without adequate neutralization. Successful exploitation could allow script execution in another user's browser when the affected content is viewed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-105269

Affected Vendors & Products

Vendor	Product	Version / Range
Satel	Satel	Netco Design 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in Satel Netco Design versions before v2.1.7. An authenticated user with Network Operator privileges can inject malicious scripts that are stored on the server. When other users view the affected content, the scripts execute in their browsers without proper neutralization.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary scripts in the browsers of other users, potentially leading to session hijacking, data theft, or unauthorized actions on behalf of the victim. Users with Network Operator privileges are the primary risk for exploitation.

Mitigation Strategies

Update Satel Netco Design to version 2.1.7 or later to address the stored cross site scripting vulnerability. Restrict Network Operator privileges to trusted users only.

Hi! I’m here to help you understand CVE-2026-105269. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70