CVE-2026-19061

LOW

Insta InstaKNXServiceApp Firmware Update CreateWebClientAndDownloadFileList data authenticity

Title source: cna
STIX 2.1

Description

A flaw has been found in Insta InstaKNXServiceApp 1.2.3.1469. Affected by this issue is the function CreateWebClientAndDownloadFileList of the component Firmware Update Handler. Executing a manipulation can lead to insufficient verification of data authenticity. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.

References (5)

Core 5
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-386531 | Insta InstaKNXServiceApp Firmware Update CreateWebClientAndDownloadFileList data authenticity
https://vuldb.com/vuln/386531
Signature, Permissions Required signature permissions-required
VDB-386531 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/386531/cti
Third Party Advisory third-party-advisory
CVE-2026-19061 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-19061
Third Party Advisory third-party-advisory
Submit #864343 | Insta GmbH InstaKNXServiceApp_v1.2.3.1469.etsapp v1.2.3.1469 Insufficient Verification of Data Authenticity
https://vuldb.com/submit/864343

Scores

CVSS v3 3.7
EPSS 0.0018
EPSS Percentile 7.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-345
Status published
Products (1)
Insta/InstaKNXServiceApp 1.2.3.1469
Published Aug 06, 2026
Tracked Since Aug 07, 2026