CVE-2026-19061 - Vulnerability Details

- Insta InstaKNXServiceApp Firmware Update CreateWebClientAndDownloadFileList data authenticity

Description

A flaw has been found in Insta InstaKNXServiceApp 1.2.3.1469. Affected by this issue is the function CreateWebClientAndDownloadFileList of the component Firmware Update Handler. Executing a manipulation can lead to insufficient verification of data authenticity. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitation is known to be difficult. There are still doubts about whether this vulnerability truly exists. The vendor explains: "[T]he entry suggests that the device does not verify the authenticity of the update. This is incorrect. The device performs an authenticity check after the complete update has been transferred. If this check fails, the update is not installed and the previously installed firmware continues to run".

Published: 2026-08-06

Score: 6.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw has been identified in Insta's InstaKNXServiceApp firmware update handler, specifically in the CreateWebClientAndDownloadFileList function of the firmware update component. The vulnerability is caused by insufficient verification of data authenticity during update manipulation. According to the vendor, an authenticity check is performed after the entire firmware update has been transferred, and if this check fails the update is not installed, leaving the previous firmware intact. The vulnerability, however, could potentially allow a remote attacker to influence the update process, though exploitation is described as highly complex and difficult, and doubts remain about whether the flaw truly exists. The weakness is identified as CWE-345, indicating insufficient verification of data authenticity.

Affected Systems

Insta's InstaKNXServiceApp, specifically version 1.2.3.1469, is impacted. No other versions or products are listed.

Risk and Exploitability

The CVSS score of 6.3 indicates a moderate severity assessment. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely documented exploitation yet. The attack vector is remote, but the description notes that exploitation is highly complex and difficult, which may reduce the likelihood of an immediate real‑world attack.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Insta

InstaKNXServiceApp

affected

Version	Status	Constraints
`1.2.3.1469`	affected	—

No data.

Vendor Product Confidence Versions

Insta

Instaknxserviceapp

95%

Version	Status	Scheme	Platform
`1.2.3.1469`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest firmware release that includes the security fix once it becomes available
Configure the firmware update mechanism to enforce strict authenticity checks, such as digital signature or hash verification
Restrict or disable remote firmware updates to authorized users only, ensuring that all update channels are verified
Monitor event logs for suspicious firmware download or update activity

Generated by OpenCVE AI on October 17, 2026 at 09:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity High

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00218.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://gist.github.com/isZzzz/f9da7d76cf2f7b93ec3f90efe17ed323
https://vuldb.com/cve/CVE-2026-19061
https://vuldb.com/submit/864343
https://vuldb.com/vuln/386531
https://vuldb.com/vuln/386531/cti

History

Tue, 13 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
Description	A flaw has been found in Insta InstaKNXServiceApp 1.2.3.1469. Affected by this issue is the function CreateWebClientAndDownloadFileList of the component Firmware Update Handler. Executing a manipulation can lead to insufficient verification of data authenticity. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.	A flaw has been found in Insta InstaKNXServiceApp 1.2.3.1469. Affected by this issue is the function CreateWebClientAndDownloadFileList of the component Firmware Update Handler. Executing a manipulation can lead to insufficient verification of data authenticity. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitation is known to be difficult. There are still doubts about whether this vulnerability truly exists. The vendor explains: "[T]he entry suggests that the device does not verify the authenticity of the update. This is incorrect. The device performs an authenticity check after the complete update has been transferred. If this check fails, the update is not installed and the previously installed firmware continues to run".
Metrics	cvssV2_0 `{'score': 2.6, 'vector': 'AV:N/AC:H/Au:N/C:N/I:P/A:N/E:ND/RL:ND/RC:UR'}`	cvssV2_0 `{'score': 2.6, 'vector': 'AV:N/AC:H/Au:N/C:N/I:P/A:N/E:ND/RL:ND/RC:UC'}`

Sat, 08 Aug 2026 03:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 06 Aug 2026 22:15:00 +0000

Type	Values Removed	Values Added
Description		A flaw has been found in Insta InstaKNXServiceApp 1.2.3.1469. Affected by this issue is the function CreateWebClientAndDownloadFileList of the component Firmware Update Handler. Executing a manipulation can lead to insufficient verification of data authenticity. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
Title		Insta InstaKNXServiceApp Firmware Update CreateWebClientAndDownloadFileList data authenticity
First Time appeared		Insta Insta instaknxserviceapp
Weaknesses		CWE-345
CPEs		cpe:2.3:a:insta:instaknxserviceapp::::::::
Vendors & Products		Insta Insta instaknxserviceapp
References		https://gist.github.com/isZzzz/f9da7d76cf2f7b93ec3f90efe17ed323 https://vuldb.com/cve/CVE-2026-19061 https://vuldb.com/submit/864343 https://vuldb.com/vuln/386531 https://vuldb.com/vuln/386531/cti
Metrics		cvssV2_0 `{'score': 2.6, 'vector': 'AV:N/AC:H/Au:N/C:N/I:P/A:N/E:ND/RL:ND/RC:UR'}` cvssV3_0 `{'score': 3.7, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R'}` cvssV3_1 `{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R'}` cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X'}`

Subscriptions

Insta Instaknxserviceapp

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-08-06T17:00:09.377Z

Updated: 2026-10-13T12:58:33.068Z

Reserved: 2026-08-06T08:29:01.612Z

Link: CVE-2026-19061

Vulnrichment

Updated: 2026-08-08T02:15:07.074Z

NVD

Status : Deferred

Published: 2026-08-06T22:16:53.253

Modified: 2026-10-13T13:17:29.827

Link: CVE-2026-19061

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-17T09:45:06Z

Weaknesses

CWE-345
Insufficient Verification of Data Authenticity

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity High

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object