PT-2026-45397 · Orca · Orca Heat Pump
CVSS v3.1
6.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Orca heat pump devices (affected versions not specified)
Description
Missing authentication and clear-text transmission of data from heat pumps to the control server, combined with a lack of input validation on aggregated data, allow for stored Cross-Site Scripting (XSS). This occurs because older devices communicate with the Orca server via unencrypted and unauthenticated HTTP connections on non-secure ports. An attacker can impersonate a legitimate device to inject malicious payloads into the Orca user portal, which may lead to the theft of cookies from the web control interface, compromise of user accounts, and exposure of sensitive information.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
XSS
Cleartext Transmission of Sensitive Information
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Orca Heat Pump