This vulnerability (CVE-2026-27870) involves improper neutralization of input during web page generation (CWE-79) in the Teldat Regesta Smart HD-PLC - TLDPH16D2 device, version 11.02.05.10.02. An attacker who has network access and can perform registration can inject malicious JavaScript code into the 'Hostname' field of the device's configuration file. This injected code is then executed in the context of the device's web interface at the endpoint /upgrade/query.php?cmd=p+3%3Bversion, resulting in a cross-site scripting condition. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond high privileges, user interaction required, low confidentiality impact, and no integrity or availability impact. No known exploits are reported in the wild, and no vendor-provided patch or mitigation is documented.

Successful exploitation allows an attacker with network access and registration privileges to execute arbitrary JavaScript in the context of the device's web interface. This could lead to session hijacking, unauthorized actions via the web interface, or other client-side attacks. The confidentiality impact is low, and there is no impact on integrity or availability as per the CVSS vector. The vulnerability requires the attacker to have high privileges and user interaction, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Until a patch is available, restrict network access to the device's management interface to trusted users only and limit registration privileges to trusted administrators. Monitor vendor communications for updates on remediation.