Kieback & Peter DDC Building Controllers

A cross-site scripting (XSS) vulnerability exists in the Kieback & Peter DDC Building Controllers web interface that allows an attacker to inject malicious code into the browser of an authenticated user. If a facility operator clicks on a malicious link while logged into the controller, the attacker can execute arbitrary code in the context of the web session, potentially modifying building automation settings or stealing session tokens. The vulnerability affects DDC4002, DDC4100, DDC4200, DDC4200-L, DDC4400, DDC4002e, DDC4200e, DDC4400e, DDC4020e, DDC4040e, and DDC520 controllers up to specified firmware versions. Older models (DDC4002, DDC4100, DDC4200, DDC4200-L, DDC4400) are end-of-maintenance and will not receive patches; newer models (DDC4002e, DDC4200e, DDC4400e, DDC4020e, DDC4040e, DDC520) have patches available. The vendor recommends these systems be isolated in secure OT networks behind firewalls, accessed only by trusted personnel, and that users avoid accessing the web portal through untrusted links.