Satel Netco Design
Satel Netco Design before 2.1.7 has XSS, ReDoS, and path traversal that could enable code execution.
CISA advisory ICSA-26-281-03 describes vulnerabilities in Satel Netco Design versions before 2.1.7, a communications-sector product from Finland. CVE-2026-105269 is stored cross-site scripting requiring Network Operator privileges. Authenticated Viewer users can trigger inefficient regular-expression processing (CVE-2026-104628) and relative path traversal on import (CVE-2026-105275) and export (CVE-2026-101024); the export issue is scored CVSS 8.8 and may allow file modification and, under some conditions, code execution. Satel advises updating to version 2.1.7. Alex Williams of Pellera Technologies reported the issues.
- Stored XSS needs Network Operator rights and runs in another user's browser.
- A Viewer can trigger ReDoS and relative path traversal on import and export.
- Export traversal may write files and, in some cases, execute code.
- Satel fixes the issues in Netco Design 2.1.7; Pellera Technologies reported them.
- Vendors
- Satel
- Products
- Netco Design
- Organizations
- CISASatelPellera Technologies
- Countries
- Finland
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-101024+3 related CVEs | Relative Path Traversal in Satel Netco Design Export | 8.7 group max | — |
From the original article
4 min read at cisa.govView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary scripts in a user's browser, consume excessive system resources, enumerate files, create or modify files, and potentially execute arbitrary code. The following versions of Satel Netco Design are affected: Satel Netco Design CVSS Vendor Equipment v3 8.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.