CVE-2026-25599
Missing authentication and clear‑text data transmission affecting Orca heat pumps
- Published
- Updated
- Reserved
- Assigned by
- ENISA
Description
Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump’s web control interface. Older Orca heat pump devices communicating with the Orca server over an unencrypted and unauthenticated HTTP connection on a non-secure port specifically enable an attacker to impersonate a legitimate device and inject malicious payloads. This enables the insertion of harmful code directly into the Orca user portal, potentially compromising user accounts, exposing sensitive information, and allowing further unauthorized actions within the portal.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| ENISACNA (assigner) | 3.1 | Medium6.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L |
| NVDNVD · Awaiting Analysis | 3.1 | Medium6.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L |
- EPSS (exploitation in 30 days)
- 0.11% · top 98% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.3.
Weakness
- CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') (opens in a new tab)All about CWE-79 and its CVEs
- CWE-306 Missing authentication for critical function (opens in a new tab)All about CWE-306 and its CVEs
- CWE-319 Cleartext transmission of sensitive information (opens in a new tab)All about CWE-319 and its CVEs
Affected products
- affected < 2.1.0
Orca Energy · Orca user portal
- affected < 1.19
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-25599)Record last updated .