vulnerability
Kieback & Peter DDC Building Controllers
Medium
Summary
This CISA advisory details a cross-site scripting (XSS) vulnerability affecting several versions of Kieback & Peter’s DDC Building Controllers. The vulnerability, CVE-2026-4293, allows an attacker to execute JavaScript code within the victim’s browser, potentially leading to unauthorized control. Building automation systems are vulnerable when directly accessible from untrusted networks, and the vendor recommends strict network segmentation and firmware updates to mitigate the risk.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data