Satel Netco Design
Satel Netco Design before 2.1.7 has XSS, ReDoS, and path traversal that could enable code execution.
42
CVE-2026-105269
Stored XSS in Satel Netco Design before v2.1.7
- CVSS 4.0
- 8.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Satel Netco Design versions before v2.1.7 contain a stored cross-site scripting flaw (CWE-79). An authenticated user who already has Network Operator privileges can save untrusted content that the application later renders without adequate neutralization. When another user views that content, the stored script can run in their browser, with high impact to confidentiality, integrity, and availability of the vulnerable system (CVSS 4.0 base 8.5). Only Satel Netco Design installations older than v2.1.7 are described as affected. There is no known public proof of concept, and the CVE is not listed in CISA KEV, so exploitation in the wild is not known.
What to do: Upgrade Satel Netco Design to v2.1.7 or later. Until then, restrict Network Operator accounts to trusted staff, review stored network-design content for unexpected markup or scripts, and avoid opening untrusted stored views in browsers used for administration.
| Product | Affected |
|---|---|
| Satel Netco Design | prior to v2.1.7 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Satel Netco Design versions prior to v2.1.7 contains a stored cross site scripting vulnerability. An authenticated user with Network Operator privileges could store untrusted content that is rendered without adequate neutralization. Successful exploitation could allow script execution in another user's browser when the affected content is viewed.
- Weakness
- CWE-79
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X