CVE-2026-110970: Lack of traffic encryption in Płatnik
Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own.
This issue was fixed in metric 242 in version 10.02.002.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Płatnikto a version that resolves this vulnerability.Fixed in 10.02.002
Event History
Frequently Asked Questions
Which installations are affected?
The issue was fixed in metric 242 in version 10.02.002. Installations that have not received that fix may still download updates, libraries, and support files over HTTP.
What does an attacker need to exploit this issue?
An attacker needs the ability to perform a man-in-the-middle attack on the network path used by Płatnik when it downloads files. User interaction is required according to the supplied severity vector.
What could an attacker do through a successful attack?
An attacker could obtain data transmitted during HTTP downloads and replace original update, library, or support files with attacker-controlled files.