CVE-2026-25599

Missing authentication and clear‑text data transmission affecting Orca heat pumps

Published Jun 1, 2026 CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Description

Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump’s web control interface. Older Orca heat pump devices communicating with the Orca server over an
unencrypted and unauthenticated HTTP connection on a non-secure port specifically enable an
attacker to impersonate a legitimate device and inject malicious
payloads. This enables the insertion of harmful code directly
into the Orca user portal, potentially compromising user accounts,
exposing sensitive information, and allowing further unauthorized
actions within the portal.

Analysis

Technical impact

The vulnerability arises from missing authentication and clear‑text data transmission between Orca heat pumps and the control server, combined with absent input validation on received aggregated data. This allows attackers to store cross‑site scripting payloads that can steal session cookies from the pump’s web control interface, leading to theft of user credentials and the possibility of further unauthorized actions within the user portal.

Affected Systems

Affected products are Orca Energy’s Orca heat pump and its Orca user portal. Older heat pump devices that communicate with the control server over an unencrypted and unauthenticated HTTP connection on a non‑secure port are particularly vulnerable.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity, and the EPSS score is not available, while the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw remotely over the network by impersonating a legitimate device and injecting malicious code, which then executes stored XSS in the user portal to steal cookies and potentially compromise user accounts.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Orca Energy

Orca heat pump

unaffected

Version	Status	Constraints
`0`	affected	< 2.1.0

Orca Energy

Orca user portal

unaffected

Version	Status	Constraints
`0`	affected	< 1.19

No data.

Vendor Product Versions

Orca Energy

Orca Heat Pump

Version	Status	Scheme	Platform
`[0,2.1.0)`	affected	semver	—

Orca Energy

Orca User Portal

Version	Status	Scheme	Platform
`[0,1.19)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the heat pump firmware to a version that requires authenticated and encrypted communication with the control server
Patch the user portal to validate and sanitize all aggregated data before rendering to eliminate the stored XSS avenue
Deploy a web application firewall or enforce browser security controls to block XSS attempts until official patches are applied

Generated by OpenCVE AI on June 1, 2026 at 12:23 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.114% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.cert.si/en/cve-2026-25599/

History

Jun 3, 2026 2:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Orca Energy Orca Energy orca Heat Pump Orca Energy orca User Portal
Vendors & Products		Orca Energy Orca Energy orca Heat Pump Orca Energy orca User Portal

Jun 1, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 1, 2026 11:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump’s web control interface. Older Orca heat pump devices communicating with the Orca server over an unencrypted and unauthenticated HTTP connection on a non-secure port specifically enable an attacker to impersonate a legitimate device and inject malicious payloads. This enables the insertion of harmful code directly into the Orca user portal, potentially compromising user accounts, exposing sensitive information, and allowing further unauthorized actions within the portal.
Title		Missing authentication and clear‑text data transmission affecting Orca heat pumps
Weaknesses		CWE-306 CWE-319 CWE-79
References		https://www.cert.si/en/cve-2026-25599/
Metrics		cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L'}`

Subscriptions

Orca Energy Orca Heat Pump Orca User Portal

Weaknesses

CWE-306
Missing Authentication for Critical Function
CWE-319
Cleartext Transmission of Sensitive Information
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')