This vulnerability (CVE-2026-27868) involves the insertion of sensitive information into sent data (CWE-201) in the Teldat Regesta Smart HD-PLC - TLDPH16D2 device, specifically version 11.02.05.10.02. An attacker with network access can exploit the issue by issuing a command via the path /upgrade/query.php?cmd=p+3&3Bversion to retrieve privileged information without authentication or registration. The CVSS 4.0 base score is 6.9, reflecting a medium severity with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact. No vendor advisory or patch is currently available, and no known exploits in the wild have been reported.

An unauthenticated attacker with network access can obtain sensitive privilege information from the affected device, potentially exposing configuration or operational details that could aid further attacks or unauthorized access. The confidentiality impact is limited but significant enough to warrant attention. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected device to trusted users only and monitor for suspicious requests targeting the /upgrade/query.php endpoint. No official remediation or workaround has been published by the vendor at this time.