CVE-2026-4293

Summary

The affected Kieback & Peter DDC building controllers are vulnerable to cross-site scripting, enabling JavaScript to be executed by the victim's browser, which allows the attacker to control the browser.

Affected Software

VendorProductVersion RangeStatus
Kieback & PeterDDC40020 <= 1.12.14affected
Kieback & PeterDDC41000 <= 1.12.14affected
Kieback & PeterDDC42000 <= 1.12.14affected
Kieback & PeterDDC4200-L0 <= 1.12.14affected
Kieback & PeterDDC44000 <= 1.12.14affected
Kieback & PeterDDC4002e0 <= 1.23.4affected
Kieback & PeterDDC4200e0 <= 1.23.4affected
Kieback & PeterDDC4400e0 <= 1.23.4affected
Kieback & PeterDDC4020e0 <= 1.23.4affected
Kieback & PeterDDC4040e0 <= 1.23.4affected
Kieback & PeterDDC5200 <= 1.24.1affected

Weaknesses

  • CWE-79: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')

Workarounds

Kieback & Peter DDC Building Controllers are developed and designed for use in closed building automation networks. The system is protected by a multi-level perimeter against attacks, especially from outside, by dividing it into operational technology (OT) zones with firewalls. Building automation systems (BA systems) in general should not be directly accessible from untrusted networks, especially from the Internet, but should be protected by consistently applying the defense-in-depth strategy. This concept is supported by organizational measures in the building as part of a safety management system. In order to achieve safety, measures are required at all levels. The DDC4002, DDC4100, DDC4200, DDC4200-L and DDC4400 controllers are end-of-maintenance, therefore the recommendations for these devices are as follows: 

  • These devices must be operated in a strictly separate OT environment.

Only trusted individuals should be granted network access to the DDC web portal. *
 Access to the web portal should be disabled in the device configuration if not required. *
 Users should be informed that only links from trusted sources should be used to access the web service. *
 Restrict network access to the device *
 Do not directly connect the device to the Internet For DDC520, DDC4002e, DDC4200e, DDC4400e, DDC4020e, and DDC4040e controllers,  Kieback & Peter

recommends the following safety measures:

  • Restrict network access to the device
  • Do not directly connect the device to the Internet

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References