CVE-2026-4293Kieback & Peter DDC Building Controllers Cross-site Scripting
- 5.3MediumCVSS base score
- 0.27%Exploitation in 30 daysEPSS · top 80% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
The affected Kieback & Peter DDC building controllers are vulnerable to cross-site scripting, enabling JavaScript to be executed by the victim's browser, which allows the attacker to control the browser.
Timeline
ID reserved
By icscert
- 2 months later
· 2 months later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| icscertCNA (assigner) | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVDNVD · Deferred | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.27% · top 80% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.
Affected products
- affected ≤ 1.12.14
- affected ≤ 1.12.14
- affected ≤ 1.12.14
- affected ≤ 1.12.14
- affected ≤ 1.12.14
- affected ≤ 1.23.4
- affected ≤ 1.23.4
- affected ≤ 1.23.4
- affected ≤ 1.23.4
- affected ≤ 1.23.4
- affected ≤ 1.24.1
What to do
Solution: For DDC520, DDC4002e, DDC4200e, DDC4400e, DDC4020e, and DDC4040e controllers, update the firmware to the latest available version: * DDC4002e: Update to version 1.23.5 or newer * DDC4200e: Update to version 1.23.5 or newer * DDC4400e: Update to version 1.23.5 or newer * DDC4020e: Update to version 1.23.5 or newer * DDC4040e: Update to version 1.23.5 or newer * DDC520: Update to version 1.24.2 or newer
Workaround: Kieback & Peter DDC Building Controllers are developed and designed for use in closed building automation networks. The system is protected by a multi-level perimeter against attacks, especially from outside, by dividing it into operational technology (OT) zones with firewalls. Building automation systems (BA systems) in general should not be directly accessible from untrusted networks, especially from the Internet, but should be protected by consistently applying the defense-in-depth strategy. This concept is supported by organizational measures in the building as part of a safety management system. In order to achieve safety, measures are required at all levels.
Workaround: The DDC4002, DDC4100, DDC4200, DDC4200-L and DDC4400 controllers are end-of-maintenance, therefore the recommendations for these devices are as follows: * These devices must be operated in a strictly separate OT environment. * Only trusted individuals should be granted network access to the DDC web portal. * Access to the web portal should be disabled in the device configuration if not required. * Users should be informed that only links from trusted sources should be used to access the web service. * Restrict network access to the device * Do not directly connect the device to the Internet
Workaround: For DDC520, DDC4002e, DDC4200e, DDC4400e, DDC4020e, and DDC4040e controllers, Kieback & Peter recommends the following safety measures: * Restrict network access to the device * Do not directly connect the device to the Internet
References
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-31125 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-4293)Record last updated .