CVE-2026-27867
MediumCVSS 4.8Summary
The Regesta Smart HD-PLC device from Teldat (model TLDPH16D2) with vulnerable firmware version 11.02.06.00.02 is vulnerable to Cross-Site Scripting (XSS). An attacker with network access (registration required) can inject a specific payload via the 'cmdcookie' parameter in /upgrade/index.html.
Risk Assessment
An attacker can perform an XSS attack, potentially leading to session theft or unauthorized actions in the device interface.
Recommendation
Update the Regesta Smart HD-PLC firmware to a version newer than 11.02.06.00.02 or contact the vendor for a patch.
Other vulnerabilities in Regesta Smart HD-PLC
See all- CVE-2026-27870Medium
A Cross-Site Scripting (XSS) vulnerability in the Regesta Smart HD-PLC device from Teldat allows an authenticated network attacker to inject arbitrary JavaScript via the 'Hostname' field in the configuration file. The script executes in the context of the /upgrade/query.php?cmd=p+3%3Bversion path.
- CVE-2026-27869Medium
A vulnerability in the Teldat Regesta Smart HD-PLC device allows an unauthenticated network attacker to perform a Slow Loris attack, causing Denial of Service (DoS) on the web interface. The issue affects firmware version TLDPH16D2 11.02.05.10.02.
- CVE-2026-27868Medium
A vulnerability in the Teldat Regesta Smart HD-PLC device allows an attacker with network access (no authentication required) to obtain privilege information by sending a Version request to the path /upgrade/query.php?cmd=p+3&3Bversion. This affects firmware version TLDPH16D2 11.02.05.10.02.
Original NVD description (English source)
An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action is required) who has the vulnerable firmware version could inject a specific payload via the parameter "cmdcookie" withing the /upgrade/index.html resulting in to a Cross-Site Scripting (XSS). This issue affects Regesta Smart HD-PLC - TLDPH16D2: 11.02.06.00.02
Vulnerability data from NVD (NIST) · CISA KEV · EPSS