CVE-2026-27870
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A Cross-Site Scripting (XSS) vulnerability in the Regesta Smart HD-PLC device from Teldat allows an authenticated network attacker to inject arbitrary JavaScript via the 'Hostname' field in the configuration file. The script executes in the context of the /upgrade/query.php?cmd=p+3%3Bversion path.
Risk Assessment
The risk includes potential session hijacking, credential theft, or unauthorized actions in the management interface, which could compromise network security.
Recommendation
Immediately update the Regesta Smart HD-PLC firmware to a version later than 11.02.05.10.02 and restrict network access to the management interface to trusted hosts only.
Other vulnerabilities in Regesta Smart HD-PLC
See all- CVE-2026-27869Medium
A vulnerability in the Teldat Regesta Smart HD-PLC device allows an unauthenticated network attacker to perform a Slow Loris attack, causing Denial of Service (DoS) on the web interface. The issue affects firmware version TLDPH16D2 11.02.05.10.02.
- CVE-2026-27868Medium
A vulnerability in the Teldat Regesta Smart HD-PLC device allows an attacker with network access (no authentication required) to obtain privilege information by sending a Version request to the path /upgrade/query.php?cmd=p+3&3Bversion. This affects firmware version TLDPH16D2 11.02.05.10.02.
Original NVD description (English source)
An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action IS required) who has the vulnerable software could, introduce arbitrary JavaScript by injecting a Cross-site Scripting (XSS) payload into the 'Hostname' field of the configuration file resulting in a XSS in the path /upgrade/query.php?cmd=p+3%3Bversion. This issue affects Regesta Smart HD-PLC - TLDPH16D2: 11.02.05.10.02.