Insta InstaKNXServiceApp 1.2.3.1469 Firmware Update CreateWebClientAndDownloadFileList data authenticity ⚔ [Disputed]

Summaryinfo

A vulnerability was found in Insta InstaKNXServiceApp 1.2.3.1469. It has been classified as problematic. This affects the function CreateWebClientAndDownloadFileList of the component Firmware Update Handler. The manipulation leads to data authenticity. This vulnerability is documented as CVE-2026-19061. The attack can be initiated remotely. There is not any exploit available. There is ongoing doubt regarding the real existence of this vulnerability. The vendor explains: "[T]he entry suggests that the device does not verify the authenticity of the update. This is incorrect. The device performs an authenticity check after the complete update has been transferred. If this check fails, the update is not installed and the previously installed firmware continues to run".

Detailsinfo

A vulnerability was found in Insta InstaKNXServiceApp 1.2.3.1469. It has been rated as problematic. This issue affects the function CreateWebClientAndDownloadFileList of the component Firmware Update Handler. The manipulation with an unknown input leads to a data authenticity vulnerability. Using CWE to declare the problem leads to CWE-345. The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. Impacted is integrity.

It is possible to read the advisory at gist.github.com. The identification of this vulnerability is CVE-2026-19061. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

The real existence of this vulnerability is still doubted at the moment. The vendor explains: "[T]he entry suggests that the device does not verify the authenticity of the update. This is incorrect. The device performs an authenticity check after the complete update has been transferred. If this check fails, the update is not installed and the previously installed firmware continues to run".

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Insta

Name

• InstaKNXServiceApp

Version

• 1.2.3.1469

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #864343: Insta GmbH InstaKNXServiceApp_v1.2.3.1469.etsapp v1.2.3.1469 Insufficient Verification of Data Authenticity (by isZzzzz)

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion