CVE-2026-27867CWE-79cross-site-scripting

CVE-2026-27867

published September 25, 2026

CVSS
4.8
EPSS
0%
Percentile
29.7
In the wild
Unconfirmed
What it is

An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action is required) who has the vulnerable firmware version could inject

a specific payload via the parameter "cmdcookie" withing the /upgrade/index.html resulting in to a Cross-Site Scripting (XSS). This issue affects Regesta Smart HD-PLC - TLDPH16D2:

11.02.06.00.02

The record
Technical detail
CVSS
4.8 · NONE
CVSS v4.0
4.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00370 · 29.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-25T15:17Z
References (5)
https://support.teldat.com/images/content/docs/Teldat_dm1087_regesta_smart_nessum_series_installation(1).pdf · ffb98d57-deaa-4918-a669-5225ccc13e39https://support.teldat.com/portal/supportcontent?page=cgs-customer-global-support&none=true&language=en-US · ffb98d57-deaa-4918-a669-5225ccc13e39https://www.hackrtu.com/blog/CNA-CVE-2026-27867/ · ffb98d57-deaa-4918-a669-5225ccc13e39https://www.hackrtu.com/blog/CNA-HRTU-0004/ · ffb98d57-deaa-4918-a669-5225ccc13e39https://www.teldat.com/es/ · ffb98d57-deaa-4918-a669-5225ccc13e39
EPSS history
Timeline
  • 27 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 25 SEP 10:32Z
    CROSS-SITE SCRIPTING (XSS) VIA THE CMDCOOKIE PARAMETER REGESTA SMART HD-PLC OF TELDAT
    cvelistv5