The vulnerability CVE-2026-25599 in Orca Energy's Orca heat pump involves improper neutralization of input during web page generation (CWE-79), missing authentication (CWE-306), and clear-text data transmission (CWE-319). Older Orca heat pump devices communicate with the control server over unencrypted and unauthenticated HTTP connections on non-secure ports. This setup allows attackers to impersonate legitimate devices and inject malicious payloads into aggregated data sent to the Orca user portal. The injected code can be stored and executed in the web interface, enabling cross-site scripting attacks that may steal cookies and compromise user accounts and sensitive information.

The vulnerability can lead to stored cross-site scripting attacks on the Orca heat pump web control interface. Exploitation may result in theft of authentication cookies, compromise of user accounts, exposure of sensitive data, and unauthorized actions within the Orca user portal. The CVSS 3.1 base score is 6.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using older Orca heat pump devices that communicate over unencrypted HTTP connections. Network-level mitigations such as restricting access to the device interface and using VPNs or secure tunnels may reduce exposure. Monitoring for unusual activity on the Orca user portal is advisable. Do not rely on generic mitigations; follow vendor updates closely.