CISA ICSA-26-281-03: Satel Netco Design XSS/Path Traversal/RCE Vulnerabilities

Vulnerability Overview Vulnerability Name: Satel Netco Design Release Date: October 8, 2026 Alert Code: ICSA-26-281-03 Related Topics: Industrial Control Systems Vulnerabilities, Industrial Control Systems Scope of Impact Affected Versions: Satel Netco Design v3.8.8 Vendor: Satel Device: Satel Netco Design Vulnerability Details 1. CVE-2026-105269 - Description: Stored cross-site scripting (XSS) vulnerability in versions of Satel Netco Design prior to v2.1.7. An authenticated user with network operator privileges can store uncleaned untrusted content, which executes scripts in the browsers of other users when viewed. - CVSS Score: Not provided 2. CVE-2026-104628 - Description: Inefficient Regular Expression Complexity (ReDoS) vulnerability in versions of Satel Netco Design prior to v2.1.7. An authenticated user with viewer privileges can submit crafted search inputs, causing excessive processing and potentially degrading the availability of the application. - CVSS Score: Not provided 3. CVE-2026-105275 - Description: Relative path traversal vulnerability in versions of Satel Netco Design prior to v2.1.7. An authenticated user with viewer privileges can access file paths outside the expected directories on the host system and determine the existence of files using observable application responses. - CVSS Score: Not provided 4. CVE-2026-101024 - Description: Relative path traversal vulnerability in versions of Satel Netco Design prior to v2.1.7. An authenticated user with viewer privileges can write files to file system locations accessible by the application service. Successful exploitation may lead to unauthorized file creation or modification and, under certain conditions, arbitrary code execution. - CVSS Score: Not provided Remediation Recommended Practices: - Minimize the network exposure of all control system devices and/or systems, ensuring they are not accessible from the Internet. - Place control system networks and remote devices behind firewalls and isolate them from business networks. - When remote access is required, use more secure remote access methods, such as Virtual Private Networks (VPNs), and recognize that VPNs may have vulnerabilities and should be updated to the latest version. - Organizations should conduct appropriate impact analysis and risk assessment before deploying defensive measures. - Implement recommended cybersecurity strategies to proactively defend ICS assets. - Take the following measures to protect yourself from social engineering attacks: - Do not click links in email messages or open unsolicited attachments. - Refer to “Identifying and Avoiding Email Scams” for more information. - Refer to “Avoiding Social Engineering and Phishing Attacks” for more information. Additional Information Background: - Critical Infrastructure Sector: Communications - Deployed Countries/Regions: Global - Company Headquarters Location: Finland Acknowledgements: - Alex Williams of Pellera Technologies reported these vulnerabilities to CISA. Legal Notice and Terms of Use: - This product is subject to this notice and the Privacy and Use Policy. Revision History: - Initial Release Date: 2026-10-08 - Revision: 1 - Summary: Initial Release Tags Sector: Communications Sector Topics: Industrial Control Systems Vulnerabilities, Industrial Control Systems Related Advisories Grid Protection Alliance openPDC and openHistorian Red Lion Controls N-Tron 700 Series Hitachi Energy SOI Johnson Controls EasyIO FG Feedback Share your thoughts: We recently updated our anonymous product survey and welcome your feedback. Footer CISA Central - Phone: 1-844-Say-CISA - Email: contact@cisa.dhs.gov CISA.gov - Official website of the U.S. Department of Homeland Security Related Links: - About CISA - Budget and Performance - DHS.gov - FOIA Requests - The No FEAR Act - Office of Inspector General - Privacy Policy - Subscribe - The White House - USA.gov - Website Feedback Summary This page details four security vulnerabilities in Satel Netco Design software, including stored cross-site scripting, inefficient regular expression complexity, and relative path traversal. It provides affected versions, vendor information, vulnerability details, recommended practices, background information, acknowledgements, legal notices, revision history, tags, related advisories, feedback, and footer information.

Goal Reached Thanks to every supporter — we hit 100%!

CISA ICSA-26-281-03: Satel Netco Design XSS/Path Traversal/RCE Vulnerabilities

More from this source