{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-11-04T07:52:23.127","vulnerabilities":[{"cve":{"id":"CVE-2026-25599","sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","published":"2026-06-01T11:16:24.643","lastModified":"2026-07-22T07:10:00.107","vulnStatus":"Awaiting Analysis","cveTags":[{"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump’s web control interface. Older Orca heat pump devices communicating with the Orca server over an \nunencrypted and unauthenticated HTTP connection on a non-secure port specifically enable an\n attacker to impersonate a legitimate device and inject malicious \npayloads. This enables the insertion of harmful code directly\n into the Orca user portal, potentially compromising user accounts, \nexposing sensitive information, and allowing further unauthorized \nactions within the portal."},{"lang":"es","value":"La ausencia de autenticación y la transmisión de datos en texto claro desde las bombas de calor al servidor de control, combinadas con la ausencia de validación de entrada en los datos agregados, pueden llevar a XSS almacenado que permite el robo de cookies de la interfaz de control web de la bomba. Los dispositivos de bomba de calor Orca más antiguos que se comunican con el servidor Orca a través de una conexión HTTP no cifrada y no autenticada en un puerto no seguro permiten específicamente a un atacante suplantar la identidad de un dispositivo legítimo e inyectar cargas útiles maliciosas. Esto permite la inserción de código dañino directamente en el portal de usuario de Orca, comprometiendo potencialmente cuentas de usuario, exponiendo información sensible y permitiendo acciones no autorizadas adicionales dentro del portal."}],"affected":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","affectedData":[{"vendor":"Orca Energy","product":"Orca heat pump","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.1.0","versionType":"semver","status":"affected"}]},{"vendor":"Orca Energy","product":"Orca user portal","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.19","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-01T13:01:12.777564Z","id":"CVE-2026-25599","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-319"}]}],"references":[{"url":"https://www.cert.si/en/cve-2026-25599/","source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}]}}]}