Satel Netco Design EUVD-2026-95286

Exploitation requires (1) a valid account at Viewer privilege level or higher on a Satel Netco Design instance prior to v2.1.7, and (2) use of the data export functionality to supply a relative path containing traversal sequences. The primary limiting factor is authentication - anonymous/unauthenticated access does not suffice (PR:L). The full arbitrary-code-execution impact is further gated by deployment-specific conditions (per the advisory's 'under certain conditions'), namely that the attacker can write to a file system location the application service subsequently executes or loads; absent such a writable-then-executed path, impact is limited to unauthorized file creation or modification within locations accessible to the application service account.

This is a credible but conditional priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack requiring only low-level authentication (Viewer privileges), with high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H) - consistent with a path-traversal file-write that can escalate to code execution. However, authentication IS required (PR:L), which meaningfully constrains opportunistic exploitation and distinguishes this from a fully unauthenticated bug. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so there is no evidence of active exploitation - this is no public exploit identified at time of analysis. The RCE outcome is explicitly described as conditional ('under certain conditions'), so the VA:H/VI:H rating reflects a worst-case path-write-to-execution scenario rather than a guaranteed one; the base case is unauthorized file creation/modification. Net: a genuine high-severity flaw in an OT product warranting prompt patching for exposed deployments, but not a drop-everything mass-exploitation event given the authentication requirement and absence of KEV/POC/EPSS signals.

An attacker who holds or obtains low-privilege Viewer credentials uses the data export feature to supply a crafted relative path (e.g. containing ../ sequences), causing the application service to write attacker-controlled content outside the intended export directory. By targeting a location the service later executes or loads, the attacker can corrupt data or, under the right conditions, achieve arbitrary code execution. No public proof-of-concept is identified in the available data.