On October 8, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory about several critical vulnerabilities in Satel Netco Design, a software used in communication and industrial control infrastructure. Versions before 2.1.7 contain four major flaws identified by CVE‑2026‑105269, CVE‑2026‑104628, CVE‑2026‑105275, and CVE‑2026‑101024.
The first flaw, CVE‑2026‑105269, is a stored cross‑site scripting (XSS) vulnerability. An authenticated user with Network Operator privileges can store unfiltered content that is rendered without neutralization. When another user views this content, a malicious script can execute in their browser, compromising the user interface security.
The second flaw, CVE‑2026‑104628, involves an inefficient regular expression. An authenticated user with Viewer privileges can submit a specially crafted search query that causes excessive processing, potentially leading to service degradation or denial of service.
The last two flaws, CVE‑2026‑105275 and CVE‑2026‑101024, are relative path traversal vulnerabilities. The former affects the data import function, allowing an authenticated user to access file paths outside the intended directory. The latter affects the data export function, permitting the attacker‑influenced content to be written to file system locations accessible to the application. In some cases, these actions can lead to arbitrary code execution.
Satel recommends updating to version 2.1.7, which fixes all known vulnerabilities. No public exploitation has been reported to CISA so far, but the severity (CVSS scores up to 8.8) warrants swift action.
Additionally, CISA advises reducing network exposure of industrial control devices, placing them behind firewalls, and using secure VPNs for remote access. Following cybersecurity best practices, such as regular software updates, log monitoring, and staff training against social engineering, is also recommended.