Satel Netco Design CVE-2026-105269

Requires an authenticated session with Network Operator privileges (PR:H) to inject the stored payload, and requires a second user to subsequently view the affected content in their browser (UI:P) for the script to fire. Exploitation is therefore limited to attackers who already possess or compromise a privileged operator account and depends on victim interaction; it does not work against an unauthenticated or non-interacting target. Affected: Satel Netco Design versions prior to v2.1.7; mitigation is upgrading to v2.1.7.

This is a stored XSS (CWE-79) in Satel Netco Design, an OT/ICS product, rated CVSS 4.0 8.5 (High). The only provided vector is CVSS 4.0 (AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N): network-reachable and low complexity, but gated by PR:H - exploitation requires an already-authenticated account with Network Operator privileges - and by UI:P, meaning a second victim user must view the poisoned content. No EPSS score, KEV listing, POC, or SSVC decision data was provided. The CVSS 4.0 impact triad (VC:H/VI:H/VA:H) is notably aggressive for a stored XSS whose real effect is script execution in another user's browser; typical XSS impact is partial confidentiality/integrity, so the High-across-the-board rating likely reflects the privileged administrative context rather than direct system compromise - treat the 8.5 as a context-inflated upper bound. Net real-world priority is moderate, not critical: the high-privilege prerequisite means an attacker must already hold a trusted operator role (insider or a compromised operator credential), which sharply narrows the realistic threat population compared to an unauthenticated flaw. Absence of EPSS/KEV/POC data is not evidence of safety but does mean no active-exploitation signal is present.

A malicious or compromised Network Operator stores a crafted payload (e.g., in a device/config field) that is not adequately neutralized. When a higher-privileged administrator or another operator later opens the view rendering that content, the script executes in their authenticated browser session, enabling session/credential theft or actions in the victim's context. No public exploit code was identified, and exploitation depends on a victim viewing the poisoned content (UI:P).