Satel Netco Design
Plan PatchCVSS 8.8ICS-CERT ICSA-26-281-03Oct 8, 2026
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Satel Netco Design versions prior to 2.1.7 contain cross-site scripting (XSS), path traversal, and resource exhaustion vulnerabilities. Successful exploitation allows an attacker to execute arbitrary scripts in a user's browser, consume excessive system resources, enumerate files on the engineering workstation, and create or modify files including PLC configuration or ladder logic.
What this means
What could happen
An attacker with engineering credentials could inject malicious scripts that run in operators' browsers, potentially stealing session tokens or causing the engineering workstation to freeze. If combined with file operations, the attacker could modify PLC ladder logic files or configuration settings.
Who's at risk
Water and electric utilities using Satel Netco Design for PLC programming and configuration management on engineering workstations. Risk is highest for plants where engineering staff have direct access to the application and PLC files are stored locally.
How it could be exploited
An attacker logs into Netco Design with valid engineering workstation credentials and injects a malicious script via a vulnerable input field. The script executes in the browser of any operator or engineer who views the affected page, allowing the attacker to read or modify PLC configuration files stored on the engineering workstation's local file system.
Prerequisites
- Valid Netco Design user credentials (engineering workstation account)
- Network access to Netco Design application
- Vulnerable version deployed (<v2.1.7)
remotely exploitablerequires valid credentialsaffects engineering workstations
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (1)
ProductAffected VersionsFix Status
Netco Design<v2.1.7Fix available
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate Satel Netco Design to version 2.1.7 or later
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/0ab2827a-69f1-46de-be81-0e6e5d23d619Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.