Vulnerability-Lookup

GHSA-M272-V6VR-R4FF

Vulnerability from github – Published: 2026-06-01 12:30 – Updated: 2026-06-01 12:30

Details

Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump’s web control interface. Older Orca heat pump devices communicating with the Orca server over an unencrypted and unauthenticated HTTP connection on a non-secure port specifically enable an attacker to impersonate a legitimate device and inject malicious payloads. This enables the insertion of harmful code directly into the Orca user portal, potentially compromising user accounts, exposing sensitive information, and allowing further unauthorized actions within the portal.

Severity

6.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-25599"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-01T11:16:24Z",
    "severity": "MODERATE"
  },
  "details": "Missing authentication and clear\u2011text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump\u2019s web control interface.\u00a0Older Orca heat pump devices communicating with the Orca server over an \nunencrypted and unauthenticated HTTP connection on a non-secure port specifically enable an\n attacker to impersonate a legitimate device and inject malicious \npayloads. This enables the insertion of harmful code directly\n into the Orca user portal, potentially compromising user accounts, \nexposing sensitive information, and allowing further unauthorized \nactions within the portal.",
  "id": "GHSA-m272-v6vr-r4ff",
  "modified": "2026-06-01T12:30:32Z",
  "published": "2026-06-01T12:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25599"
    },
    {
      "type": "WEB",
      "url": "https://www.cert.si/en/cve-2026-25599"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-25599 (GCVE-0-2026-25599)

Vulnerability from cvelistv5 – Published: 2026-06-01 09:17 – Updated: 2026-06-01 13:01 Unsupported When Assigned

Title

Missing authentication and clear‑text data transmission affecting Orca heat pumps

Summary

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
CWE-306 - Missing authentication for critical function
CWE-319 - Cleartext transmission of sensitive information

Assigner

ENISA

References

1 reference

URL	Tags
https://www.cert.si/en/cve-2026-25599/

Impacted products

2 products

Vendor	Product	Version
Orca Energy	Orca heat pump	Affected: 0 , < 2.1.0 (semver)
Orca Energy	Orca user portal	Affected: 0 , < 1.19 (custom)

Credits

Tom Kern, NIL d.o.o.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25599",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-01T13:01:12.777564Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-01T13:01:21.955Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Orca heat pump",
          "vendor": "Orca Energy",
          "versions": [
            {
              "lessThan": "2.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Orca user portal",
          "vendor": "Orca Energy",
          "versions": [
            {
              "lessThan": "1.19",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tom Kern, NIL d.o.o."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing authentication and clear\u2011text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump\u2019s web control interface.\u0026nbsp;Older Orca heat pump devices communicating with the Orca server over an \nunencrypted and unauthenticated HTTP connection on a non-secure port specifically enable an\n attacker to impersonate a legitimate device and inject malicious \npayloads. This enables the insertion of harmful code directly\n into the Orca user portal, potentially compromising user accounts, \nexposing sensitive information, and allowing further unauthorized \nactions within the portal."
            }
          ],
          "value": "Missing authentication and clear\u2011text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump\u2019s web control interface.\u00a0Older Orca heat pump devices communicating with the Orca server over an \nunencrypted and unauthenticated HTTP connection on a non-secure port specifically enable an\n attacker to impersonate a legitimate device and inject malicious \npayloads. This enables the insertion of harmful code directly\n into the Orca user portal, potentially compromising user accounts, \nexposing sensitive information, and allowing further unauthorized \nactions within the portal."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing authentication for critical function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-319",
              "description": "CWE-319 Cleartext transmission of sensitive information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T09:17:51.060Z",
        "orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
        "shortName": "ENISA"
      },
      "references": [
        {
          "url": "https://www.cert.si/en/cve-2026-25599/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "Missing authentication and clear\u2011text data transmission affecting Orca heat pumps",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
    "assignerShortName": "ENISA",
    "cveId": "CVE-2026-25599",
    "datePublished": "2026-06-01T09:17:51.060Z",
    "dateReserved": "2026-02-03T07:24:49.547Z",
    "dateUpdated": "2026-06-01T13:01:21.955Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-M272-V6VR-R4FF

CVE-2026-25599 (GCVE-0-2026-25599)

Tags

Sightings

Nomenclature