EUVD-2026-54185
GHSA-v442-3w5q-c7m5
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network AitM required (AC:H); no target-side privileges needed; only integrity of downloaded file list affected (I:L), no C or A impact per CVSS 4.0 source data.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A flaw has been found in Insta InstaKNXServiceApp 1.2.3.1469. Affected by this issue is the function CreateWebClientAndDownloadFileList of the component Firmware Update Handler. Executing a manipulation can lead to insufficient verification of data authenticity. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Firmware update integrity bypass in Insta InstaKNXServiceApp 1.2.3.1469 allows a remote network-positioned attacker to serve unauthenticated firmware or file lists to the application's update handler without detection. The vulnerable function CreateWebClientAndDownloadFileList fails to cryptographically verify the authenticity of data retrieved during the firmware update process (CWE-345), enabling substitution of malicious content. No patch has been released and the vendor did not respond to coordinated disclosure; no public exploit has been independently confirmed at time of analysis, though a GitHub gist linked in references may represent researcher-published proof-of-concept material.
Technical ContextAI
InstaKNXServiceApp is a Windows service application for KNX building automation systems - a standard protocol widely used in smart home and commercial building control infrastructure. The affected component, CreateWebClientAndDownloadFileList within the Firmware Update Handler, initiates outbound HTTP/HTTPS connections to retrieve firmware manifests or file lists. CWE-345 (Insufficient Verification of Data Authenticity) indicates the application does not perform cryptographic signature validation or certificate pinning on downloaded content, making it susceptible to adversary-in-the-middle (AitM) substitution attacks. The affected version is 1.2.3.1469 as confirmed by EUVD-2026-54185. No CPE string was provided; affected platform is inferred as Windows desktop/server running the KNX service daemon.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to coordinated disclosure. As a primary compensating control, restrict the network path of hosts running InstaKNXServiceApp so firmware update connections are only permitted to known, pinned endpoints via an allowlisted firewall egress rule - this reduces AitM interception surface but does not eliminate the underlying verification flaw. Deploying TLS inspection at the network egress point to detect certificate anomalies can provide secondary detection coverage, though this introduces decryption complexity. Segmenting KNX service hosts onto an isolated VLAN with controlled internet access prevents broad AitM positioning. Monitor DNS resolution and HTTP/HTTPS requests from the InstaKNXServiceApp process for unexpected destinations. References include the VulDB entry at https://vuldb.com/vuln/386531 and the researcher gist at https://gist.github.com/isZzzz/f9da7d76cf2f7b93ec3f90efe17ed323 for technical detail.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today