Satel Netco Design
Satel Netco Design before 2.1.7 has XSS, ReDoS, and path traversal that could enable code execution.
42
Vulnerability3 · 1 read
CVE-2026-105275
Relative path traversal in Satel Netco Design
- CVSS 4.0
- 5.3 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Satel Netco Design before v2.1.7 has a relative path traversal flaw (CWE-23) in its data import function. An authenticated user who already has only Viewer privileges can supply paths that leave the intended import directory. The application’s responses reveal whether those files exist on the host, giving low confidentiality impact without changing or deleting data. Organizations running affected Netco Design installations are exposed. It is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Upgrade Satel Netco Design to v2.1.7 or later. Until then, limit Viewer (and other) accounts to trusted users, restrict network access to the application, and review import logs and host filesystem access for unexpected path probes.
| Product | Affected |
|---|---|
| Satel Netco Design | versions prior to v2.1.7 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data import functionality. An authenticated user with Viewer privileges could access file paths outside the intended directory and use observable application responses to determine whether files exist on the host system.
- Weakness
- CWE-23
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X