CVE-2026-19061— Insta InstaKNXServiceApp Firmware Update CreateWebClientAndDownloadFileList data authenticity
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Insta | InstaKNXServiceApp | 1.2.3.1469 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-19061
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Insta InstaKNXServiceApp Firmware Update CreateWebClientAndDownloadFileList data authenticity
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw has been found in Insta InstaKNXServiceApp 1.2.3.1469. Affected by this issue is the function CreateWebClientAndDownloadFileList of the component Firmware Update Handler. Executing a manipulation can lead to insufficient verification of data authenticity. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Insta | InstaKNXServiceApp | 1.2.3.1469 | cpe:2.3:a:insta:instaknxserviceapp:*:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-19061
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19061
请登录查看更多情报信息。
Other References for CVE-2026-19061 (1)
- 🔗 Page not found · GitHub · GitHubbroken-link
IV. Related Vulnerabilities
Same weakness: CWE-345
- CVE-2026-58262
Klever-Go: PubKeysBitmap padding bits bypass the BLS signatu - CVE-2026-19127
Insufficient verification of lifetime-deal redemption codes - CVE-2026-63687
Apache CXF: JwtRequestCodeFilter silently overrides outer PK - CVE-2026-65583
Apache CXF: Self-issued ID token claims validation skipped - CVE-2026-49331
Openshift/oauth-proxy: openshift/oauth-proxy: unauthenticate
V. Comments for CVE-2026-19061
No comments yet