CVE-2026-19061: Insta InstaKNXServiceApp Firmware Update CreateWebClientAndDownloadFileList data authenticity
A flaw has been found in Insta InstaKNXServiceApp 1.2.3.1469. Affected by this issue is the function CreateWebClientAndDownloadFileList of the component Firmware Update Handler. Executing a manipulation can lead to insufficient verification of data authenticity. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Insta InstaKNXServiceApp 1.2.3.1469to a version that resolves this vulnerability.Fixed in 1.2.3.1469 - Compensating control
Restrict remote access to InstaKNXServiceApp Firmware Update Handler endpoints (since the issue can be launched remotely) using network controls such as firewall/ACL so only trusted sources can reach the firmware update functionality.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19061?
The severity of CVE-2026-19061 is classified as low with a score of 3.7.
How do I fix CVE-2026-19061?
To fix CVE-2026-19061, ensure that the InstaKNXServiceApp is updated to the latest version that addresses this vulnerability.
What type of attack can occur due to CVE-2026-19061?
CVE-2026-19061 allows for an attack that involves insufficient verification of data authenticity, potentially leading to data manipulation.
Which component is affected by CVE-2026-19061?
CVE-2026-19061 affects the CreateWebClientAndDownloadFileList function within the Firmware Update Handler component.
What is the impact of CVE-2026-19061 on the InstaKNXServiceApp?
The impact of CVE-2026-19061 is that it may allow attackers to exploit insufficient data authenticity verification during firmware updates.