Is there a patch available for EUVD-2026-37577?

Yes, a patch is available for EUVD-2026-37577. Update the affected software to the latest version immediately.

Regesta Smart HD-PLC EUVD-2026-37577

Q: What is the CVSS score of EUVD-2026-37577?

EUVD-2026-37577 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-27870 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-17 HackRTU

PHP XSS Regesta Smart Hd Plc Tldph16D2

4.8

CVSS 4.0 · Vendor: HackRTU

Severity by source

Vendor (HackRTU) PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

Admin write access required to plant payload (PR:H); stored XSS crosses security principal boundary to victim browser (S:C); session and content integrity both affected (C:L/I:L).

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (HackRTU).

CVSS VectorVendor: HackRTU

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 10:16 vuln.today

DescriptionCVE.org

An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action IS required) who has the vulnerable software could, introduce arbitrary JavaScript by injecting a Cross-site Scripting (XSS) payload into the 'Hostname' field of the configuration file resulting in a XSS in the path /upgrade/query.php?cmd=p+3%3Bversion. This issue affects Regesta Smart HD-PLC - TLDPH16D2: 11.02.05.10.02.

AnalysisAI

Stored cross-site scripting in Teldat's Regesta Smart HD-PLC (TLDPH16D2, firmware 11.02.05.10.02) allows a privileged, authenticated attacker to inject arbitrary JavaScript into the device's 'Hostname' configuration field, which executes in the browser of any user who subsequently loads the /upgrade/query.php?cmd=p+3%3Bversion endpoint. The CVSS 4.0 score of 4.8 reflects meaningful constraints: high-privilege access (PR:H) is required to write the malicious configuration, and victim user interaction (UI:P) is needed to trigger execution. No public exploit identified at time of analysis and not listed in CISA KEV; a vendor patch is available.

Technical ContextAI

The Teldat Regesta Smart HD-PLC (model TLDPH16D2, CPE: cpe:2.3:a:teldat:regesta_smart_hd-plc_-_tldph16d2:*:*:*:*:*:*:*:*) is an HD-PLC (High Definition Power Line Communication) networking device with a PHP-based web management interface. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS: the PHP script at /upgrade/query.php retrieves the 'Hostname' value from the device configuration and renders it directly into the HTML response without sanitization or output encoding. Because the payload is written to persistent device configuration rather than a transient request parameter, this behaves as a stored (persistent) XSS, surviving until the configuration is overwritten. The PHP-backed management interface is the attack surface, and the injection point is the Hostname field processed during a firmware/version query operation.

RemediationAI

A vendor-released patch is available per Teldat's support portal at https://support.teldat.com/portal/supportcontent?page=cgs-customer-global-support&none=true&language=en-US; however, the exact patched firmware version number is not confirmed in the available data - administrators should consult that portal directly to retrieve the current firmware for the TLDPH16D2 model. The researcher advisory with full technical detail is at https://www.hackrtu.com/blog/CNA-CVE-2026-27870/ and https://www.hackrtu.com/blog/CNA-HRTU-0002/. As an interim compensating control prior to patching, restrict access to the device's web management interface to a dedicated, isolated management VLAN with strict ACLs limiting which hosts can reach the interface - this reduces the population of potential victims who could trigger the stored payload. Additionally, enforce multi-factor authentication and strong credential policies for administrative accounts to reduce the risk of an attacker obtaining the high-privilege access required to plant the payload. Disabling web-based management entirely and using out-of-band management would eliminate this specific attack surface at the cost of operational convenience.