PT-2026-45397 · Orca · Orca Heat Pump

Tom Kern · Published 2026-06-01 · Updated 2026-06-01 · CVE-2026-25599

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Orca heat pump devices (affected versions not specified)

Description Missing authentication and clear-text transmission of data from heat pumps to the control server, combined with a lack of input validation on aggregated data, allow for stored Cross-Site Scripting (XSS). This occurs because older devices communicate with the Orca server via unencrypted and unauthenticated HTTP connections on non-secure ports. An attacker can impersonate a legitimate device to inject malicious payloads into the Orca user portal, which may lead to the theft of cookies from the web control interface, compromise of user accounts, and exposure of sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

XSS

Missing Authentication

Weakness Enumeration

CWE-319

CWE-79

CWE-306

Related Identifiers

CVE-2026-25599

Affected Products

Orca Heat Pump

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-25599 · Security Note
• https://twitter.com/VulmonFeeds/status/2061439593736462836 · Twitter Post
• https://cert.si/en/cve-2026-25599 · Note