SATEL Netco Design: Stored cross-site scripting

Summary

Satel Netco Design versions prior to v2.1.7 contain a stored cross-site scripting vulnerability. An authenticated user with Network Operator privileges can store untrusted content that is rendered without adequate neutralization. When another user views the affected content, the attacker's script can run in that user's browser.

Affected

• Satel Netco Design, all versions prior to v2.1.7

Fixed in

• Update to Satel Netco Design v2.1.7 (vendor fix, as advised by Satel and CISA)

Workaround

• Unknown. No vendor-specific workaround identified; the fix is to update to v2.1.7.

Exploitation

• CISA reports no known public exploitation targeting this vulnerability at publication time.
• No public proof of concept found in the sources reviewed; not checked on GitHub.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Update all Netco Design installations to v2.1.7 in the normal patch cycle.
• Patch CVE-2026-104628, CVE-2026-105275 and CVE-2026-101024 at the same time (same CISA advisory).
• Review Network Operator accounts and restrict who can add content.
• Do not expose the tool to the internet; restrict access to internal networks and use secure remote access (VPN kept up to date).
• Check whether Netco Design is in use and which version is installed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CISA ICS Advisory ICSA-26-281-03 www.cisa.gov
• CISA CSAF file ICSA-26-281-03 github.com
• SATEL software downloads www.satel.com
• SATEL Netco Design product page www.satel.com
• Threatint CVE record CVE-2026-105269 cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:05.