EUVD-2026-86931
GHSA-jj76-67xg-c9gj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister/authenticate to device web UI
-
DeliveryCraft malicious cmdcookie payload
-
ExploitDeliver crafted /upgrade/index.html request to victim
-
ExecutionVictim browser executes injected script
-
ImpactSession/UI actions in victim context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated (registered) account on the Regesta Smart HD-PLC TLDPH16D2 web management interface running vulnerable firmware 11.02.06.00.02, plus network reachability to that interface. The attacker must inject the payload via the 'cmdcookie' parameter of the /upgrade/index.html resource, and successful exploitation depends on victim user interaction (a logged-in user must load/trigger the crafted request). Limiting factors: prior authentication (PR:L), mandatory user interaction (UI:A), the niche/industrial deployment of the device, and the specific affected firmware version all substantially narrow real-world exploitability. |
| Impact | This is a genuinely low-priority issue despite its network attack vector. The CVSS 4.0 base score of 4.8 (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N) already reflects the real constraints: the attacker must be authenticated (PR:L - the description explicitly states 'registration action is required') and must lure a victim into interacting with a crafted request (UI:A), and impact is limited to low confidentiality/integrity within the browser context (VC:L/VI:L, no availability impact). There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so all three exploitation-likelihood signals are absent or neutral. No signals conflict - the CVSS vector, the description, and the absence of exploitation evidence all point the same direction: a real-but-minor stored/reflected XSS in a niche industrial power-line-communication device's web management interface. This is a legitimate finding to patch, but not an urgent, mass-exploitable priority. |
| Exploit ScenarioDerived | An authenticated attacker on the device network crafts a malicious value for the 'cmdcookie' parameter of /upgrade/index.html and delivers it to another logged-in user of the Regesta Smart HD-PLC web interface. When the victim loads the crafted request, the injected payload executes JavaScript in their browser session, potentially stealing session context or performing actions in the management UI. No public proof-of-concept exploit was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Cross-site scripting in Teldat's Regesta Smart HD-PLC powerline communications device (model TLDPH16D2, firmware 11.02.06.00.02) allows an attacker who already has authenticated access to the web management interface to inject a payload through the 'cmdcookie' parameter of /upgrade/index.html, which then executes in the browser of a logged-in user who triggers the crafted request. The vulnerability is confirmed only for firmware 11.02.06.00.02 and carries a low CVSS 4.0 base score of 4.8, consistent with an independent assessment of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N that requires prior authentication (PR:L) and mandatory victim interaction (UI:R). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the niche industrial deployment of these PLC devices further narrows real-world exploitability.
RemediationAI
Patch available per vendor advisory: Teldat states a fix is available from the vendor, though the input data does not specify an exact fixed firmware version, so administrators should obtain the current firmware release and upgrade instructions through the Teldat global support portal (https://support.teldat.com/portal/supportcontent?page=cgs-customer-global-support&none=true&language=en-US) and confirm applicability against the HackRTU advisories CNA-HRTU-0004 and CNA-CVE-2026-27867 (https://www.hackrtu.com/blog/CNA-HRTU-0004/, https://www.hackrtu.com/blog/CNA-CVE-2026-27867/). Where immediate upgrade is not possible, compensating controls are: restrict network reachability to the device's web management interface so that only a trusted management VLAN or jump host can reach TCP 80/443 (side effect: remote administration and monitoring must be rerouted through that path), disable remote/WAN-side management if the device supports it (side effect: no out-of-band administration during outages), and enforce a strict policy that operators never browse other sites or open untrusted links while logged into the device, combined with short session timeouts and logout after configuration (side effect: reduced convenience and more frequent re-authentication). Because exploitation requires an authenticated account plus victim interaction, the highest-value hardening is strong, unique administrator credentials, removal of unused accounts, and alerting on unexpected POST requests to /upgrade/index.html; note that these measures reduce exposure but do not fix the underlying input-handling flaw, so firmware upgrade remains the only complete remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. cross-site scripting) in the embedded web management interface of the Teldat Regesta Smart HD-PLC. HD-PLC (High Definition Power Line Communication) devices bridge Ethernet/IP traffic over existing electrical wiring and are typically deployed in industrial, utility and building-management networks; the TLDPH16D2 is such a unit and exposes an administrative HTTP interface where the affected resource /upgrade/index.html processes a parameter named 'cmdcookie' without adequate output encoding or sanitization. The CPE string cpe:2.3:a:teldat:regesta_smart_hd-plc_-_tldph16d2:*:*:*:*:*:*:*:* identifies the affected product family, which the advisory ties specifically to firmware 11.02.06.00.02. Because the injected script executes in the security context of the device's web origin, the CVSS scope is marked Changed (S:C) with low confidentiality and integrity impact and no availability impact; exploitation presupposes that the attacker already holds a registered/authenticated session on the interface and that a logged-in user subsequently loads or triggers the crafted request, which is why the practical risk is assessed as low.
Know when Regesta Smart Hd Plc Tldph16D2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Authenticated web-interface user (PR:L) plus required victim interaction (UI:R) for a reflected XSS executing in the browser (S:C, C:L/I:L, no availability impact).
Primary rating from Vendor (HackRTU).
CVSS VectorVendor: HackRTU
DescriptionCVE.org
An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action is required) who has the vulnerable firmware version could inject a specific payload via the parameter "cmdcookie" withing the /upgrade/index.html resulting in to a Cross-Site Scripting (XSS). This issue affects Regesta Smart HD-PLC - TLDPH16D2: 11.02.06.00.02
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
The web management interface of the Teldat Regesta Smart HD-PLC (model TLDPH16D2, firmware 11.02.05.10.02) is susceptibl
Unauthenticated information disclosure in the Teldat Regesta Smart HD-PLC (model TLDPH16D2, firmware 11.02.05.10.02) exp
Stored cross-site scripting in Teldat's Regesta Smart HD-PLC (TLDPH16D2, firmware 11.02.05.10.02) allows a privileged, a
Exploit-DB