Regesta Smart HD-PLC vulnerabilities

The Regesta Smart HD-PLC device from Teldat (model TLDPH16D2) with vulnerable firmware version 11.02.06.00.02 is vulnerable to Cross-Site Scripting (XSS). An attacker with network access (registration required) can inject a specific payload via the 'cmdcookie' parameter in /upgrade/index.html.

A Cross-Site Scripting (XSS) vulnerability in the Regesta Smart HD-PLC device from Teldat allows an authenticated network attacker to inject arbitrary JavaScript via the 'Hostname' field in the configuration file. The script executes in the context of the /upgrade/query.php?cmd=p+3%3Bversion path.

A vulnerability in the Teldat Regesta Smart HD-PLC device allows an unauthenticated network attacker to perform a Slow Loris attack, causing Denial of Service (DoS) on the web interface. The issue affects firmware version TLDPH16D2 11.02.05.10.02.

A vulnerability in the Teldat Regesta Smart HD-PLC device allows an attacker with network access (no authentication required) to obtain privilege information by sending a Version request to the path /upgrade/query.php?cmd=p+3&3Bversion. This affects firmware version TLDPH16D2 11.02.05.10.02.