CISA 2026-05-19

Kieback & Peter DDC Building Controllers

CVE-2026-4293

Machine-generated analysis · WAYSCloud LLM

The advisory states that multiple Kieback & Peter DDC building controllers are affected by a cross-site scripting vulnerability allowing JavaScript execution in the victim's browser.

Context

Kieback & Peter DDC Building Controllers are building automation devices used for monitoring and controlling technical systems. The advisory states these devices are vulnerable to cross-site scripting (XSS), which could allow an attacker to execute JavaScript and take control of a user's browser. The affected models include various DDC4000, DDC4000e, and DDC520 series controllers with specific firmware versions. The advisory explicitly lists deployment in several countries and critical infrastructure sectors.

Operator considerations

- Check: inventory DDC4002, DDC4100, DDC4200, DDC4200-L, DDC4400, DDC4002e, DDC4200e, DDC4400e, DDC4020e, DDC4040e, and DDC520 devices with firmware versions listed as vulnerable
- Patch: apply firmware updates to mitigate CVE-2026-4293 as specified by the vendor
- Log: monitor web interface access logs for unauthorized or suspicious activity, given the browser-based attack vector

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could allow an attacker to take control of the victim's browser.

The following versions of Kieback & Peter DDC Building Controllers are affected:

DDC4002

Read the full advisory on CISA →