Is there a patch available for EUVD-2026-37576?

Yes, a patch is available for EUVD-2026-37576. Update the affected software to the latest version immediately.

Regesta Smart HD-PLC EUVD-2026-37576

Q: What is the CVSS score of EUVD-2026-37576?

EUVD-2026-37576 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-27868 MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-06-17 HackRTU

PHP Information Disclosure Regesta Smart Hd Plc Tldph16D2

6.9

CVSS 4.0 · Vendor: HackRTU

Severity by source

Vendor (HackRTU) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-reachable endpoint requires no authentication and returns only version metadata, so PR:N, AV:N, C:L, and no integrity or availability impact apply.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (HackRTU).

CVSS VectorVendor: HackRTU

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 10:15 vuln.today

DescriptionCVE.org

An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) who has the vulnerable software could obtain privilege information by using the command Version via the path: /upgrade/query.php?cmd=p+3&3Bversion resulting in a information disclosure. This issue affects Regesta Smart HD-PLC - TLDPH16D2: 11.02.05.10.02.

AnalysisAI

Unauthenticated information disclosure in the Teldat Regesta Smart HD-PLC (model TLDPH16D2, firmware 11.02.05.10.02) exposes version and privilege data via a PHP-based upgrade query endpoint accessible over the network without any login or registration. An attacker sends a crafted HTTP request to /upgrade/query.php?cmd=p+3&3Bversion and receives sensitive system metadata in the response, violating CWE-201 by returning information that should be restricted. No active exploitation has been confirmed (not in CISA KEV), and the direct impact is limited to confidentiality, but the exposed data can enable targeted follow-on attacks against this HD-PLC networking device.

Technical ContextAI

The Teldat Regesta Smart HD-PLC is a High Definition Power Line Communication networking device, identified by CPE cpe:2.3:a:teldat:regesta_smart_hd-plc_-_tldph16d2:*:*:*:*:*:*:*:*. The device runs a PHP-based web management interface that includes an upgrade/query subsystem at /upgrade/query.php. This endpoint accepts a cmd parameter and, when supplied with the Version command (p+3&3Bversion), responds with privilege-level and version information without enforcing any access control or session validation. The root cause is CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the application actively returns data that should be restricted - the endpoint is not merely leaking data incidentally but is designed to respond to the Version command without gating it behind authentication. This pattern is common in embedded device firmware where diagnostic or upgrade endpoints are implemented separately from the main authentication layer and inadvertently left exposed.

RemediationAI

A vendor-released patch is available per the HackRTU advisory at https://www.hackrtu.com/blog/CNA-CVE-2026-27868/ and via the Teldat customer support portal at https://support.teldat.com/portal/supportcontent. The exact fixed firmware version number was not specified in the available data, so administrators should contact Teldat support directly to obtain the corrected release and confirm the target version before deploying. As a compensating control pending patch deployment, administrators should restrict network access to the device's web management interface using firewall rules or ACLs that block external traffic to TCP port 80/443, specifically preventing access to the /upgrade/query.php path from untrusted network segments - be aware this may disrupt remote management workflows. If the device is deployed at a network perimeter, placing it behind a management VLAN or jump host will reduce exposure without functional impact to PLC data path traffic.