All vulnerabilities
CVE-2026-27867

CROSS-SITE SCRIPTING (XSS) VIA THE CMDCOOKIE PARAMETER REGESTA SMART HD-PLC OF TELDAT

Teldat Regesta Smart HD-PLC - TLDPH16D2Industrial & IoT
Open in ThreatlineRecord JSON
CVSS
4.8Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.37%Chance of exploitation activity in the next 30 days, higher than 29% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published25 Sep 2026Updated 25 Sep 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action is required) who has the vulnerable firmware version could inject a specific payload via the parameter "cmdcookie" withing the /upgrade/index.html resulting in to a Cross-Site Scripting (XSS). This issue affects Regesta Smart HD-PLC - TLDPH16D2: 11.02.06.00.02

Text from CVE List

Affected versions 2

  • Regesta Smart HD-PLC - TLDPH16D2affected: 11.02.06.00.02CVE List
  • Regesta Smart HD-PLC - TLDPH16D2unaffected: 11.02.06.00.03CVE List

References 5