# CVE-2026-25599: Missing Authentication, Clear-Text Transmission and Stored XSS in Orca Heat Pumps and Orca User Portal

> SI-CERT advisory for CVE-2026-25599: legacy Orca heat pump terminals (CAREL PGDT04000F020, firmware before 2.1) identify themselves to the Orca control server using only a device ID over unencrypted HTTP, letting an attacker impersonate a device and inject stored XSS into the Orca user portal. The portal was fixed in version 1.19; no active exploitation or public PoC is reported.

- **Published:** 2026-11-04T05:47:20Z
- **Last reviewed:** 2026-11-04T05:47:20Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5213
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5213.png
- **ID:** TL-2026-5213
- **Severity:** MEDIUM (CVSS 6.3)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 11 (2 shown free below)
- **CVEs:** CVE-2026-25599

## Description

CVE-2026-25599 (CVSS 3.1 base 6.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) combines three weaknesses affecting the Orca heat pump ecosystem operated by Orca Energy: CWE-306 (missing authentication), CWE-319 (clear-text transmission of sensitive information) and CWE-79 (stored cross-site scripting). Per the SI-CERT advisory, legacy terminals transmit only a device ID to the control server, with no additional verification, and do so over plain HTTP on a non-secure port. Because the channel is neither authenticated nor encrypted, a network attacker can impersonate a legitimate device.

The Orca user portal (moja.orca.energy) did not neutralize device-supplied data before rendering it. An attacker posing as a device could therefore inject a script payload that is stored by the backend and executed in the browser of an authenticated portal user, with the advisory describing theft of session cookies from authenticated users as the consequence. NVD describes the impact as compromise of user accounts and exposure of sensitive data; the aggregated CVE record adds that unauthorized access to an Orca account could allow remote control of the associated heat pump, including modification of operational parameters and disruption of operational stability.

Affected: Orca user portal versions before 1.19 (remediated 2026-03-09) and legacy Orca heat pump terminals based on the CAREL P/N PGDT04000F020 (ARM CPU, 256MB DDR2, 128MB flash, Windows CE 6.0) running firmware before 2.1 (NVD records < 2.1.0). Devices older than roughly five years are in scope; terminals with firmware 2.1 or later are not affected. The advisory lists the legacy proxy application OrcaDevNativeProxy.exe with SHA256 51068e96d5cc21002b618c02bd5853520d73cb6451383e4094a70ea055251d5a as the affected binary.

The vendor mitigations on the portal side are backend input validation and sanitization, output encoding of all terminal-provided data, a nonce-based Content Security Policy, and session cookies hardened with HttpOnly, Secure and SameSite=Lax. The issue was reported by Tom Kern (SOC Tech Lead, NIL d.o.o., Slovenia). The advisory states there are no known exploits in circulation and no PoC is published. Legacy terminals cannot gain the portal-side fix, so their clear-text channel remains a residual exposure until the hardware is upgraded or replaced.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1659 Content Injection
- T1557 Adversary-in-the-Middle
- T1040 Network Sniffing
- T1539 Steal Web Session Cookie
- T1185 Browser Session Hijacking
- T1565.002 Transmitted Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Orca Portal Session Cookie Replay From Multiple Sources** (`TL-2026-5213-SPL-002`)

Detects one moja.orca.energy session cookie (hashed, never kept in clear) presented from more than one source IP and more than one user agent within 24h. This is the post-exploitation outcome of CVE-2026-25599 stored XSS: a stolen session cookie replayed by the attacker while the victim stays logged in. Requires TLS-terminating proxy or WAF logs with cookie data.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1539, T1185, T1550.004
- **Data sources:** splunk_stream_http, tls_terminating_proxy, waf_logs
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

````spl
index=network sourcetype="stream:http" site="moja.orca.energy" cookie=* earliest=-24h ```comment same session cookie from several sources signals cookie theft and replay``` | eval cookie_hash=md5(cookie) | stats dc(src_ip) as src_ip_count dc(http_user_agent) as ua_count values(src_ip) as src_ips values(http_user_agent) as user_agents min(_time) as first_seen max(_time) as last_seen by cookie_hash | where src_ip_count>1 AND ua_count>1 | convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL contains "moja.orca.energy" and isnotempty(RequestCookies)
| extend CookieHash = hash_sha256(RequestCookies)
| summarize SrcIPCount = dcount(SourceIP), UACount = dcount(RequestClientApplication), SrcIPs = make_set(SourceIP, 20), UserAgents = make_set(RequestClientApplication, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by CookieHash
| where SrcIPCount > 1 and UACount > 1
```

### Sigma

```yaml
title: Orca Portal Request With Session Cookie From Scripted Client
id: 3b7e1c40-5213-4a02-9f10-a1c2d3e4f502
status: experimental
description: Single-event approximation of session cookie replay against moja.orca.energy, a request carrying a session cookie from a scripting HTTP client rather than a browser. Multi-source cookie correlation lives in the SPL and KQL forms.
references:
    - https://www.cert.si/en/cve-2026-25599/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-25599
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.credential-access
    - attack.collection
    - attack.t1539
    - attack.t1185
    - attack.lateral-movement
    - attack.t1550.004
    - cve.2026.25599
logsource:
    category: proxy
detection:
    selection_host:
        cs-host: 'moja.orca.energy'
    selection_ua:
        c-useragent|contains:
            - 'curl/'
            - 'python-requests'
            - 'Go-http-client'
            - 'Wget/'
            - 'PostmanRuntime'
            - 'libwww-perl'
    selection_cookie:
        cs-cookie|contains: '='
    condition: all of selection_*
falsepositives:
    - Authorised API integrations or monitoring scripts using the portal
    - Penetration tests
level: medium

```

**Known false positives:**

- Users roaming between mobile and Wi-Fi networks with a changed user agent string after a browser update
- Corporate proxies or VPN egress pools rotating source IPs mid-session

**Tuning notes:** Raise the source IP threshold or require different ASNs or countries to cut roaming noise. Exclude known corporate egress pools. The cookie is hashed before aggregation so raw tokens are never retained in results.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Orca Portal XSS Cookie Exfiltration Callback To Non-Orca Host (locked: unlock with TL Creds)
- Vulnerable Orca Legacy Proxy [indicator] Present Or Executed (locked: unlock with TL Creds)
- Orca Legacy Proxy Clear-Text HTTP Egress To Control Server (locked: unlock with TL Creds)
- Clear-Text HTTP Request To Orca Control Server (locked: unlock with TL Creds)
- Script Payload In Request To Orca User Portal (locked: unlock with TL Creds)
- Shell Or Script Host Spawned By Orca Legacy Proxy (locked: unlock with TL Creds)
- CVE-2026-25599 Orca Device-Channel Script Payload (Stored XSS Injection) (locked: unlock with TL Creds)
- Orca Device ID Impersonation - One Device ID From Multiple Sources (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 11)

Defanged, TLP:CLEAR.

- Domain: `moja[.]orca[.]energy`
- File hash: `51068e96d5cc21002b618c02bd5853520d73cb6451383e4094a70ea055251d5a`

Full set of 11 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [CVE-2026-25599 - Missing authentication and clear-text data transmission of Orca heat pumps (SI-CERT)](https://www.cert.si/en/cve-2026-25599/)
- [NVD - CVE-2026-25599](https://nvd.nist.gov/vuln/detail/CVE-2026-25599)
- [NVD CVE API record for CVE-2026-25599](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-25599)
- [PT-2026-45397 Orca Heat Pump (Positive Technologies dbugs)](https://dbugs.ptsecurity.com/vulnerability/PT-2026-45397)
- [CVE-2026-25599 (GCVE-0-2026-25599)](https://db.gcve.eu/vuln/cve-2026-25599)
- [CVE-2026-25599 - CERT Hrvatska CVE record](https://cve.cert.hr/cve/CVE-2026-25599)
- [CVE-2026-25599 - OpenCVE](https://app.opencve.io/cve/CVE-2026-25599)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5213