CVE-2026-27870: CROSS-SITE SCRIPTING (XSS) VIA MALICIOUS FILE UPLOAD ON REGESTA SMART HD-PLC OF TELDAT

Published Jun 17, 2026

Updated

An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action IS required) who has the vulnerable software could, introduce arbitrary JavaScript by injecting a Cross-site Scripting (XSS) payload into the 'Hostname' field of the configuration file resulting in a XSS in the path /upgrade/query.php?cmd=p+3%3Bversion. This issue affects Regesta Smart HD-PLC - TLDPH16D2: 11.02.05.10.02.

Affected Software

1 affected component

Teldat Regesta Smart HD-PLC - TLDPH16D2=11.02.05.10.02

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Regesta Smart HD-PLC - TLDPH16D2 to a version that resolves this vulnerability.
Fixed in 11.02.06.00.02

Event History

Jun 17, 2026

CVE Published

via MITRE·08:13 AM

Data Sourced

via MITRE·08:13 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-27870?

The severity of CVE-2026-27870 is medium with a CVSS score of 4.8.

How do I fix CVE-2026-27870?

To fix CVE-2026-27870, ensure that all inputs in the 'Hostname' field are properly validated and sanitized to prevent XSS attacks.

What type of vulnerability is CVE-2026-27870?

CVE-2026-27870 is a Cross-Site Scripting (XSS) vulnerability.

Who is affected by CVE-2026-27870?

CVE-2026-27870 affects users of the Teldat Regesta Smart HD-PLC with vulnerable software.

Can exploitation of CVE-2026-27870 lead to unauthorized actions?

Yes, exploitation of CVE-2026-27870 can allow attackers to execute arbitrary JavaScript within users' browsers.