Teldat Regesta Smart HD-PLC up to 11.02.05.10.02 Registration /upgrade/query.php insertion of sensitive information into sent data

Summaryinfo

A vulnerability identified as problematic has been detected in Teldat Regesta Smart HD-PLC up to 11.02.05.10.02. This affects an unknown function of the file /upgrade/query.php of the component Registration Handler. This manipulation causes insertion of sensitive information into sent data. This vulnerability appears as CVE-2026-27868. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Teldat Regesta Smart HD-PLC up to 11.02.05.10.02. Affected by this vulnerability is some unknown functionality of the file /upgrade/query.php of the component Registration Handler. The manipulation with an unknown input leads to a insertion of sensitive information into sent data vulnerability. The CWE definition for the vulnerability is CWE-201. The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. As an impact it is known to affect confidentiality. The summary by CVE is:

An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) who has the vulnerable software could obtain privilege information by using the command Version via the path: /upgrade/query.php?cmd=p+3&3Bversion resulting in a information disclosure. This issue affects Regesta Smart HD-PLC - TLDPH16D2: 11.02.05.10.02.

The weakness was presented by Aarón Flecha Menéndez and Víctor Bello Cuevas. It is possible to read the advisory at hackrtu.com. This vulnerability is known as CVE-2026-27868 since 02/24/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

By approaching the search of inurl:upgrade/query.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 11.02.06.00.02 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Teldat

Name

• Regesta Smart HD-PLC

Version

• 11.02.05.10.02

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion