CVE-2026-110970— Lack of traffic encryption in Płatnik
Quick assessment
Affected
Zakład Ubezpieczeń Społecznych Płatnik
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Płatnik 使用 HTTP 协议下载更新、库文件和支持文件，这使得攻击者能够实施中间人攻击，截获传输的数据，并将原始文件替换为攻击者提供的文件。 该问题已在 10.02.002 版本的 metric 242 中修复。
Possible ATT&CK Techniques 2 AI
T1567 · Exfiltration Over Web Service T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Zakład Ubezpieczeń Społecznych | Płatnik | ≤ 10.02.002 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110970
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Lack of traffic encryption in Płatnik
Source: CVE Program / CVE List V5
Vulnerability Description
Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own.
This issue was fixed in metric 242 in version 10.02.002.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1428
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Zakład Ubezpieczeń Społecznych | Płatnik | 0 ~ 10.02.002 | - |
|
II. Public POCs for CVE-2026-110970
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110970
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-110970 (1)
Vendor Pages for CVE-2026-110970 (1)
-
🔗 O programie Płatnik - ZUS product
Same Patch Batch · Zakład Ubezpieczeń Społecznych · 2026-10-30 · 3 CVEs total
| CVE-2026-110972 | 8.6 HIGH | Use of Client-Side Authentication in Płatnik |
| CVE-2026-110971 | 7.7 HIGH | Weak password encoding in Płatnik |