CVE-2026-25599: Missing Authentication, Clear-Text Transmission and Stored XSS in Orca Heat Pumps and Orca User Portal

Key facts for Orca heat pump spoofing

Detection coverage for Orca heat pump spoofing

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5213 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Orca Portal Session Cookie Replay From Multiple Sources

Detects one moja.orca.energy session cookie (hashed, never kept in clear) presented from more than one source IP and more than one user agent within 24h. This is the post-exploitation outcome of CVE-2026-25599 stored XSS: a stolen session cookie replayed by the attacker while the victim stays logged in. Requires TLS-terminating proxy or WAF logs with cookie data.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1539, T1185, T1550.004
• Data sources: splunk_stream_http, tls_terminating_proxy, waf_logs
• Severity: high
• Confidence: medium

Splunk SPL

index=network sourcetype="stream:http" site="moja.orca.energy" cookie=* earliest=-24h ```comment same session cookie from several sources signals cookie theft and replay``` | eval cookie_hash=md5(cookie) | stats dc(src_ip) as src_ip_count dc(http_user_agent) as ua_count values(src_ip) as src_ips values(http_user_agent) as user_agents min(_time) as first_seen max(_time) as last_seen by cookie_hash | where src_ip_count>1 AND ua_count>1 | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL contains "moja.orca.energy" and isnotempty(RequestCookies)
| extend CookieHash = hash_sha256(RequestCookies)
| summarize SrcIPCount = dcount(SourceIP), UACount = dcount(RequestClientApplication), SrcIPs = make_set(SourceIP, 20), UserAgents = make_set(RequestClientApplication, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by CookieHash
| where SrcIPCount > 1 and UACount > 1

Sigma

title: Orca Portal Request With Session Cookie From Scripted Client
id: 3b7e1c40-5213-4a02-9f10-a1c2d3e4f502
status: experimental
description: Single-event approximation of session cookie replay against moja.orca.energy, a request carrying a session cookie from a scripting HTTP client rather than a browser. Multi-source cookie correlation lives in the SPL and KQL forms.
references:
    - https://www.cert.si/en/cve-2026-25599/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-25599
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.credential-access
    - attack.collection
    - attack.t1539
    - attack.t1185
    - attack.lateral-movement
    - attack.t1550.004
    - cve.2026.25599
logsource:
    category: proxy
detection:
    selection_host:
        cs-host: 'moja.orca.energy'
    selection_ua:
        c-useragent|contains:
            - 'curl/'
            - 'python-requests'
            - 'Go-http-client'
            - 'Wget/'
            - 'PostmanRuntime'
            - 'libwww-perl'
    selection_cookie:
        cs-cookie|contains: '='
    condition: all of selection_*
falsepositives:
    - Authorised API integrations or monitoring scripts using the portal
    - Penetration tests
level: medium

Known false positives:

• Users roaming between mobile and Wi-Fi networks with a changed user agent string after a browser update
• Corporate proxies or VPN egress pools rotating source IPs mid-session

Tuning notes: Raise the source IP threshold or require different ASNs or countries to cut roaming noise. Exclude known corporate egress pools. The cookie is hashed before aggregation so raw tokens are never retained in results.

• 🔒 Orca Portal XSS Cookie Exfiltration Callback To Non-Orca Host · unlock with TL Creds
• 🔒 Vulnerable Orca Legacy Proxy [indicator] Present Or Executed · unlock with TL Creds
• 🔒 Orca Legacy Proxy Clear-Text HTTP Egress To Control Server · unlock with TL Creds
• 🔒 Clear-Text HTTP Request To Orca Control Server · unlock with TL Creds
• 🔒 Script Payload In Request To Orca User Portal · unlock with TL Creds
• 🔒 Shell Or Script Host Spawned By Orca Legacy Proxy · unlock with TL Creds
• 🔒 CVE-2026-25599 Orca Device-Channel Script Payload (Stored XSS Injection) · unlock with TL Creds
• 🔒 Orca Device ID Impersonation - One Device ID From Multiple Sources · unlock with TL Creds

Indicators of compromise for Orca heat pump spoofing

As of 2026-11-04, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5213.

Sample indicators (2 of 11)

• Domain: moja[.]orca[.]energy
• File hash: 51068e96d5cc21002b618c02bd5853520d73cb6451383e4094a70ea055251d5a

Defanged, TLP:CLEAR. Full set of 11 indicators: unlock with TL Creds.

How Orca heat pump spoofing works

The portal was fixed in version 1.19; no active exploitation or public PoC is reported.

CVE-2026-25599 (CVSS 3.1 base 6.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) combines three weaknesses affecting the Orca heat pump ecosystem operated by Orca Energy: CWE-306 (missing authentication), CWE-319 (clear-text transmission of sensitive information) and CWE-79 (stored cross-site scripting). Per the SI-CERT advisory, legacy terminals transmit only a device ID to the control server, with no additional verification, and do so over plain HTTP on a non-secure port. Because the channel is neither authenticated nor encrypted, a network attacker can impersonate a legitimate device.

The Orca user portal (moja.orca.energy) did not neutralize device-supplied data before rendering it. An attacker posing as a device could therefore inject a script payload that is stored by the backend and executed in the browser of an authenticated portal user, with the advisory describing theft of session cookies from authenticated users as the consequence. NVD describes the impact as compromise of user accounts and exposure of sensitive data; the aggregated CVE record adds that unauthorized access to an Orca account could allow remote control of the associated heat pump, including modification of operational parameters and disruption of operational stability.

Affected: Orca user portal versions before 1.19 (remediated 2026-03-09) and legacy Orca heat pump terminals based on the CAREL P/N PGDT04000F020 (ARM CPU, 256MB DDR2, 128MB flash, Windows CE 6.0) running firmware before 2.1 (NVD records < 2.1.0). Devices older than roughly five years are in scope; terminals with firmware 2.1 or later are not affected. The advisory lists the legacy proxy application OrcaDevNativeProxy.exe with SHA256 51068e96d5cc21002b618c02bd5853520d73cb6451383e4094a70ea055251d5a as the affected binary.

The vendor mitigations on the portal side are backend input validation and sanitization, output encoding of all terminal-provided data, a nonce-based Content Security Policy, and session cookies hardened with HttpOnly, Secure and SameSite=Lax. The issue was reported by Tom Kern (SOC Tech Lead, NIL d.o.o., Slovenia). The advisory states there are no known exploits in circulation and no PoC is published. Legacy terminals cannot gain the portal-side fix, so their clear-text channel remains a residual exposure until the hardware is upgraded or replaced.

MITRE ATT&CK techniques by tactic:

Credential Access

T1040 Network Sniffing; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle

Collection

T1185 Browser Session Hijacking

Initial Access

T1190 Exploit Public-Facing Application; T1659 Content Injection

Impact

T1565.002 Transmitted Data Manipulation

Remediation for Orca heat pump spoofing

Patches

• Orca user portal 1.19 (input validation, output encoding, CSP, HttpOnly/Secure/SameSite=Lax cookies)
• Orca heat pump terminal firmware 2.1 or later

Immediate actions

• Confirm Orca user portal is at version 1.19 or later (vendor-hosted fix deployed 2026-03-09)
• Identify legacy Orca terminals (CAREL PGDT04000F020) with firmware earlier than 2.1
• Monitor for unencrypted HTTP traffic from heat pump terminals to the Orca control server and for device-ID reuse from unexpected sources

Workarounds

• Restrict legacy terminal traffic to the vendor control server through firewall allow-listing
• Log out of the Orca portal when not in use and rotate account credentials if compromise is suspected

Longer-term hardening

• Replace or upgrade legacy terminals to firmware 2.1 or later hardware
• Place heat pump terminals on segmented networks and do not expose them to untrusted networks
• Use a nonce-based Content Security Policy and output encoding for all device-supplied data in web portals

Affected and fixed versions

• Orca Energy — Orca user portal
  Vulnerable versions: < 1.19
  Fixed in: 1.19
• Orca Energy — Orca heat pump (legacy CAREL PGDT04000F020 terminal)
  Vulnerable versions: firmware < 2.1
  Fixed in: firmware 2.1 and later

Timeline of Orca heat pump spoofing

• 2026-01-05 Researcher locked-ioc-10 (locked-ioc-9) makes initial contact regarding the Orca heat pump vulnerabilities
• 2026-01-09 Report and vendor notification period begins (January 9-14, 2026 per SI-CERT)
• 2026-01-14 Vendor notification window closes with the report delivered to the affected parties
• 2026-03-09 Orca user portal stored XSS fixed (version 1.19) with input validation, output encoding, CSP and hardened session cookies
• 2026-04-17 SI-CERT publishes the advisory for CVE-2026-25599; no known exploits reported
• 2026-06-01 CVE-2026-25599 published in NVD with CVSS 3.1 base score 6.3 (Medium)
• 2026-07-22 NVD record last modified

Sources cited for Orca heat pump spoofing

• CVE-2026-25599 - Missing authentication and clear-text data transmission of Orca heat pumps (SI-CERT) cert.si · Advisory · 2026-04-17
• NVD - CVE-2026-25599 NVD (NIST) · Advisory · 2026-06-01
• NVD CVE API record for CVE-2026-25599 NVD (NIST) · Research · 2026-06-01
• PT-2026-45397 Orca Heat Pump (Positive Technologies dbugs) dbugs.ptsecurity.com · Research · 2026-06-01
• CVE-2026-25599 (GCVE-0-2026-25599) db.gcve.eu · Research · 2026-06-01
• CVE-2026-25599 - CERT Hrvatska CVE record cve.cert.hr · Research · 2026-06-01
• CVE-2026-25599 - OpenCVE app.opencve.io · Research · 2026-06-01

More in vulnerability

• SolarWinds Dameware Command Injection Vulnerability (CVE-2026-28336)
• CVE-2026-25600: Hard-coded Cryptographic Secret in Trac d.o.o. PDBM (Process Database Manager) 1.0.0.0 Enables Administrative Credential Decryption
• Microsoft Analysis: 78% of Exploited Vulnerabilities Enable System Takeover and Privilege Escalation
• Android November 2026 Security Bulletin: Over 200 Vulnerabilities Patched, Including Critical Framework RCE (CVE-2026-58868)
• Docker Sandboxes (sbx CLI) Symlink Vulnerability Lets AI Agents Read/Write Host Files Outside Sandbox (CVE-2026-103916)