Satel Netco Design CVE-2026-105275

Exploitation requires valid authenticated access to Satel Netco Design at minimum Viewer privilege level, and specifically requires use of the data import functionality, which is the vulnerable feature processing the attacker-supplied relative path. The flaw is network-reachable (AV:N) and needs no user interaction, but the mandatory low-privilege authentication (PR:L) is the primary limiting factor, confining risk to parties who already possess credentials. Impact is further limited to inferring file existence from observable application responses - it does not by itself yield file contents, write access, or code execution. Only versions prior to v2.1.7 are affected; upgrading to v2.1.7 remediates the issue.

This is a genuine but low-priority finding, not a critical emergency. The CVSS 4.0 base score is 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N and impact limited to VC:L (low confidentiality) with no integrity or availability effect - meaning the vulnerability only lets an attacker infer whether files exist, not read, modify, or disrupt them. Critically, PR:L confirms authentication is required: an attacker must already hold at least Viewer-level credentials, which substantially narrows the real-world threat population to insiders or attackers who have already obtained valid low-privilege access. No EPSS score, CISA KEV listing, or public proof-of-concept is present in the provided data, so there is no evidence of active or imminent exploitation. The signals are mutually consistent (network-reachable but authenticated, low technical impact, no exploitation telemetry), so there is no conflict to flag - the main caveat is simply that the absence of EPSS/KEV/POC data could reflect either genuinely low interest or incomplete intelligence at analysis time.

An authenticated user holding only Viewer privileges on Satel Netco Design abuses the data import feature by submitting crafted relative paths (e.g. ../../ sequences) pointing outside the intended import directory. By observing differences in the application's responses (such as error vs. success behavior), the attacker maps which files exist on the host filesystem, enabling reconnaissance for a follow-on attack. No public exploit code is identified in the provided data.