CVE-2026-25599— Missing authentication and clear‑text data transmission affecting Orca heat pumps
Possible ATT&CK Techniques 3AI
T1078 · Valid Accounts T1556 · Modify Authentication Process T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-25599
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Missing authentication and clear‑text data transmission affecting Orca heat pumps
Source: NVD (National Vulnerability Database)
Vulnerability Description
Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump’s web control interface. Older Orca heat pump devices communicating with the Orca server over an unencrypted and unauthenticated HTTP connection on a non-secure port specifically enable an attacker to impersonate a legitimate device and inject malicious payloads. This enables the insertion of harmful code directly into the Orca user portal, potentially compromising user accounts, exposing sensitive information, and allowing further unauthorized actions within the portal.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Orca Energy | Orca heat pump | 0 ~ 2.1.0 | - | |
| Orca Energy | Orca user portal | 0 ~ 1.19 | - |
II. Public POCs for CVE-2026-25599
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-25599
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-25599 (1)
IV. Related Vulnerabilities
Same weakness: CWE-79
- CVE-2026-42676
WordPress myCred plugin <= 3.0.4 - Cross Site Scripting (XSS - CVE-2026-42678
WordPress GiveWP plugin <= 4.14.5 - Cross Site Scripting (XS - CVE-2026-42681
WordPress e2pdf plugin <= 1.32.14 - Reflected Cross Site Scr - CVE-2026-42683
WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1. - CVE-2026-48839
WordPress WP Statistics plugin <= 14.16.6 - Cross Site Scrip
V. Comments for CVE-2026-25599
No comments yet