EUVD-2026-95317
GHSA-q2m5-3896-5wf4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with Viewer account
-
ExploitSubmit crafted search input
-
ExecutionTrigger catastrophic regex backtracking
-
ImpactExhaust CPU and degrade application availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Regex complexity limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated account with at least Viewer privileges on the Satel Netco Design application (PR:L) and network access to its search functionality; exploitation is performed by submitting crafted search input that triggers inefficient regular-expression processing. Limiting factors: this is NOT unauthenticated - an attacker must first obtain Viewer-level credentials - and impact is confined to availability (CPU/processing exhaustion) with no data disclosure or modification. Affected deployments are those running versions prior to v2.1.7; no non-default feature toggle is indicated beyond use of the application's search input. |
| Impact | This is a moderate, authentication-gated availability issue rather than a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: network-reachable, low attack complexity, requires low privileges (PR:L maps to the stated 'Viewer' account), no user interaction, and impact limited strictly to availability (VA:H) with zero confidentiality or integrity effect. The 7.1 score is driven almost entirely by the availability impact of a ReDoS (CWE-1333). No EPSS score was provided, so exploitation probability cannot be quantified; KEV status is absent (not listed), and no POC is referenced - therefore there is no public exploit identified at time of analysis. The key limiting factor that holds real-world risk down is PR:L: an attacker must already hold a valid authenticated Viewer account, so this is not an unauthenticated pre-auth DoS. Net: a legitimate patch-worthy issue for operators of this specific OT product, but it is a bounded, authenticated, availability-only weakness - not a widespread high-urgency threat, and the absence of EPSS/KEV/POC signals supports a lower real-world priority than the 7.1 alone might imply. |
| Exploit ScenarioDerived | An attacker who already possesses (or has compromised) a low-privilege Viewer account logs into the Satel Netco Design web application and submits a specially crafted string into a search field. The malicious input triggers catastrophic regular-expression backtracking, consuming excessive CPU and degrading or denying availability of the application for other users. No public exploit code is referenced, and successful abuse requires valid authentication (PR:L) over the network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Authenticated users holding only Viewer privileges on Satel Netco Design can degrade availability of the application by submitting specially crafted search input that drives excessive processing in the product's regular-expression handling. The issue affects all versions prior to v2.1.7 and is rated CVSS 7.1 (CVSS 4.0) / High under CVSS 3.1 for availability impact alone - there is no confidentiality or integrity loss. Exploitation requires a valid, low-privileged account and network reachability to the search functionality; no public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV).
RemediationAI
Vendor-released patch: v2.1.7 - upgrade Satel Netco Design to v2.1.7 or later as the primary and definitive fix, and verify the installed build after upgrade since the advisory covers the entire pre-2.1.7 range; details and any vendor-specific installation guidance are in CISA ICS advisory ICSA-26-281-03 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-03). If the upgrade cannot be performed on the required maintenance schedule, compensating controls should target both the low-privilege access path and the processing cost: audit and prune Viewer accounts to the minimum set of personnel who genuinely need search access (directly removes the PR:L prerequisite for insiders and stale accounts, at the cost of some workflow friction), remove or disable external/IT-network reachability of the application's search interface so only engineering-segment clients can reach it (an effective containment control if the product is not internet-facing in your deployment, but it does not protect against a malicious legitimate user), and apply request rate limiting and maximum request-duration timeouts at a reverse proxy or WAF in front of the application to cap the CPU burn from any single crafted query (note that generic WAF signatures cannot reliably distinguish a ReDoS payload from a valid search string, and aggressive timeouts may terminate legitimate long-running queries). Operational monitoring for sustained CPU saturation or worker-thread exhaustion on the application host, correlated with search endpoint activity and per-account request volume, provides early warning and helps attribute an event to a specific Viewer credential. Restricting or disabling the search feature entirely is the strongest interim mitigation but typically makes the product unusable for its intended purpose and should be treated only as a short-term, incident-driven measure.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-1333, Inefficient Regular Expression Complexity - commonly referred to as ReDoS or catastrophic backtracking. The application passes attacker-influenced search input into a regular expression engine (typically for filtering, matching, or query parsing over records), and a crafted string causes the engine to explore an exponential or super-linear number of backtracking paths. Critically, the vulnerable regex is ordinary here: the input is the malicious component, so signature-style payload blocking is unreliable since a valid, legitimate-looking search string can be the trigger. Consistent with the ICS advisory icsa-26-281-03, the CPE identifier cpe:2.3:a:satel:satel_netco_design:*:*:*:*:*:*:*:* designates the entire Satel Netco Design product line as vulnerable up to (but excluding) the fixed release v2.1.7, meaning version detection is a prerequisite for any exposure assessment. Because consumption occurs on the application server's CPU thread, the practical effect is single-thread or worker-pool exhaustion, leading to slow responses or denial of service rather than memory corruption, code execution, or data exposure. Satel Netco Design is sold as network design/planning tooling, so instances are frequently deployed on internal engineering networks; network position - not exploit sophistication - is the dominant exposure factor, and the low-privilege Viewer role requirement is typical of read-only accounts provisioned broadly for staff, auditors, or integrators.
Know when Satel Netco Design gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable search endpoint with low complexity, but requires an authenticated Viewer account so PR:L; only availability is affected (ReDoS), so C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
DescriptionCVE.org
Satel Netco Design versions prior to v2.1.7 contains an inefficient regular expression complexity vulnerability. An authenticated user with Viewer privileges could submit crafted search input that causes excessive processing, potentially degrading the availability of the application.
Executive ViewAI
Satel Netco Design deployments running versions earlier than v2.1.7 are exposed to a high-severity availability flaw that can be triggered by any user with Viewer access, potentially causing service degradation or denial of service for all users. Because the vulnerability affects a core search function and no vendor-released patch identified at time of analysis, business operations relying on this application may face unplanned downtime. Leadership should treat this as a medium-term risk requiring immediate compensating controls until an official fix is released.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting search functionality to trusted networks, enforcing strict least privilege for Viewer accounts, implementing input validation and rate limiting, deploying WAF rules to detect and block malicious regex patterns, and monitoring for anomalous search activity. Consider disabling search if not business-critical.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Satel Netco Design
View allRelative path traversal in Satel Netco Design versions prior to v2.1.7 lets an authenticated user holding only Viewer pr
Stored cross-site scripting in Satel Netco Design versions prior to v2.1.7 allows an authenticated user with Network Ope
An authenticated user with Viewer privileges can exploit a relative path traversal flaw in the data import functionality
Exploit-DB