Teldat vulnerabilities

Products

• Regesta Smart HD-PLC - TLDPH16D2 4
• rs123 firmware 2
• rs123w firmware 2
• m1 1
• m1 firmware 1

Latest Teldat CVEs

Newest publication first

1. CVE-2026-27867 CROSS-SITE SCRIPTING (XSS) VIA THE CMDCOOKIE PARAMETER REGESTA SMART HD-PLC OF TELDAT

   Published 2026-09-25

   Medium·CVSS 4.8 EPSS 0.37%

   An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action is required) who has the vulnerable firmware version could inject a specific payload via the parameter "cmdcookie" withing the /upgrade/index.html resulting i...

2. CVE-2026-27870 CROSS-SITE SCRIPTING (XSS) VIA MALICIOUS FILE UPLOAD ON REGESTA SMART HD-PLC OF TELDAT

   Published 2026-06-17

   Medium·CVSS 4.8 EPSS 0.29%

   An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action IS required) who has the vulnerable software could, introduce arbitrary JavaScript by injecting a Cross-site Scripting (XSS) payload into the 'Hostname' field...

3. CVE-2026-27869 WEB SERVICE (HTTP) DENIAL OF SERVICE VIA SLOW HEADERS ON REGESTA SMART HD-PLC OF TELDAT

   Published 2026-06-17

   Medium·CVSS 6.9 EPSS 0.39%

   An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) who has the vulnerable software could, with a Slow Loris attack, cause Denial of Service (DoS) on the web interface of the device. This issue...

4. CVE-2026-27868 PUBLICATION OF SENSITIVE INFORMATION ON REGESTA SMART HD-PLC OF TELDAT

   Published 2026-06-17

   Medium·CVSS 6.9 EPSS 0.39%

   An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) who has the vulnerable software could obtain privilege information by using the command Version via the path: /upgrade/query.php?cmd=p+3&3Bver...

5. CVE-2022-39996 Cross Site Scripting vulnerability in Teldats Router RS123, RS123w allows attacker to execute arbitrary code via the cmdcookie parameter to the upgrade/query.php page.

   Published 2024-08-27

   Medium·CVSS 4.8 EPSS 0.34%

   Cross Site Scripting vulnerability in Teldats Router RS123, RS123w allows attacker to execute arbitrary code via the cmdcookie parameter to the upgrade/query.php page.

6. CVE-2022-39997 A weak password requirement issue was discovered in Teldats Router RS123, RS123w allows a remote attacker to escalate privileges

   Published 2024-08-27

   High·CVSS 8.0 EPSS 0.29%

   A weak password requirement issue was discovered in Teldats Router RS123, RS123w allows a remote attacker to escalate privileges

7. CVE-2024-36829 Incorrect access control in Teldat M1 v11.00.05.50.01 allows attackers to obtain sensitive information via a crafted query string.

   Published 2024-06-26

   High·CVSS 7.5 EPSS 0.39%

   Incorrect access control in Teldat M1 v11.00.05.50.01 allows attackers to obtain sensitive information via a crafted query string.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.