Płatnik EUVD-2026-113774

The attacker must hold a Man-in-the-Middle position on the HTTP connection Płatnik uses to download updates, libraries, and support files - i.e. control of or presence on the network path (shared/rogue LAN or Wi-Fi, ARP/DNS spoofing, or a compromised upstream hop) - because the client fetches these resources over cleartext HTTP rather than an authenticated/encrypted channel. Exploitation additionally requires the user to initiate or accept a download (UI:P/passive user interaction), so it is not autonomous. Limiting factors: the MITM prerequisite is a meaningful barrier (reflected as AT:P), impact is bounded to Low confidentiality and Low integrity with no availability impact per CERT-PL, and the flaw is remediated by updating to version 10.02.002 (metric 242). The specific resources affected are updates, libraries, and support files as stated in the description.

Real-world risk is LOW and the vuln.today 'monitor' decision label is appropriate. The CVSS 4.0 base score is 2.3 with vector AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N: although the attack vector is Network and no privileges are required, exploitation carries an Attack Requirement (AT:P - the attacker must achieve a Man-in-the-Middle position on the HTTP path) and passive user interaction (UI:P - the victim must initiate/accept an update download), and the assessed impact is only Low confidentiality and Low integrity with no availability impact. No EPSS score, no CISA KEV listing, and no PoC or exploit reference are present in the input, so there is no exploitation-probability or active-exploitation signal to weigh - the only contrary signal is that the issue was reported by CERT-PL, a credible national CERT. One point of tension worth noting: the description says an attacker can 'replace the original files with their own', which for downloaded libraries/updates could in principle enable code execution (a higher integrity/availability impact), yet CERT-PL scored integrity only as Low (VI:L) and availability as None (VA:N); the lower vendor/CERT rating is used here, but defenders handling environments where replaced files are auto-executed may wish to verify the ceiling with CERT-PL. Overall this is a genuine but low-priority transport-security weakness, not a high-CVSS-but-low-risk inflation case - the score itself is low and consistent with the mechanism.

An attacker positioned on the network path between a Płatnik installation and the ZUS/update servers (e.g. on a shared or compromised LAN, rogue Wi-Fi, or an intercepted upstream link) observes the client fetching updates, libraries, or support files over cleartext HTTP. The attacker reads the transmitted data and substitutes attacker-controlled files for the legitimate ones when the user triggers a download. No public exploit or PoC is identified at time of analysis, and the attack is gated by the need to hold a MITM position and by the user action that starts the download.