CVE-2026-105275

Executive Summary

CVE-2026-105275 is a relative path traversal vulnerability (CWE-23) in the data import functionality of Satel Netco Design software versions prior to v2.1.7. An authenticated user holding only Viewer privileges can supply crafted traversal sequences that cause the application to resolve file paths outside the intended directory, and can then use differences in application responses to infer whether arbitrary files exist on the host system. The direct impact is limited confidentiality loss (file existence disclosure and potentially low-sensitivity file reads), but the low privilege bar (authenticated Viewer) makes the flaw a useful reconnaissance primitive in a multi-stage intrusion.

Technical Analysis

The vulnerability resides in the data import feature of Satel Netco Design. According to the NVD description, the application does not adequately neutralize relative path sequences (e.g., ../) before resolving a user-supplied path during import processing. This is a classic directory traversal (path traversal) condition mapped to CWE-23 ("Relative Path Traversal").

The core weakness is an absence of path canonicalization and allow-listing: user-controlled input that determines a filesystem path is concatenated or resolved without verifying that the resulting canonical path remains within the intended import directory. When traversal sequences are accepted, the resolved path can escape the intended directory tree.

Two distinct outcomes are described in the source data:

1. Path access outside the intended directory — the application can be induced to reference file paths outside the designated import location.
2. File existence disclosure via observable responses — the attacker does not necessarily need the file contents to be returned. Instead, they exploit observable differences in application responses (for example, differing error messages, status codes, timing, or partial output) to determine whether a given file exists on the host. This is effectively an oracle-based file system enumeration primitive.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N indicates:

• AV:N — exploitable over the network (the application interface is remotely reachable).
• AC:L — no special attack complexity; the traversal primitive is reliably triggerable.
• PR:L — requires low privileges, consistent with the stated Viewer account requirement (authentication is mandatory).
• UI:N — no victim interaction required.
• S:U — impact remains within the application's security scope.
• C:L / I:N / A:N — only limited confidentiality impact, no integrity or availability impact.

Because the description explicitly frames the impact as file existence determination rather than file content exfiltration, the confidentiality rating is limited (C:L), not high. No code-level function names, parameters, or endpoints are provided in the source description, so this analysis deliberately restricts itself to the vulnerability class and observed behavior. Insufficient technical detail is available to identify the exact parameter name or the precise response-differentiation mechanism; the CWE-23 classification and the NVD narrative are the authoritative anchors.

Exploitation Scenarios

No public PoC is available (POC_STATUS: None), and no Nuclei template or exploit code is tracked. The following chain is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. An attacker identifies an internet- or intranet-exposed Satel Netco Design deployment running a version prior to v2.1.7. Version fingerprinting may be performed via the login page, application banners, or response headers. Since exploitation requires authentication, the attacker must also obtain or already possess a low-privileged Viewer account — through credential reuse, default credentials, phishing, or an unrelated access-broker channel.

2. Triggering the flaw class. After authenticating as a Viewer, the attacker navigates to the data import functionality and supplies input that contains relative traversal sequences (e.g., ../ segments) in the field used to specify the file path for import. Because the application fails to canonicalize or allow-list the resulting path, the path resolution escapes the intended import directory.

3. Execution / oracle probing (vulnerability-class level). Rather than attempting to read file contents directly, the attacker submits candidate paths to common system files and observes how the application responds. Differences in responses — error text, status code, presence/absence of an import result, or processing behavior — act as a boolean oracle: one class of response indicates the path exists, another indicates it does not. By iterating candidate paths, the attacker enumerates the host file system. No specific file paths, endpoints, or parameter names are asserted here because the source data does not provide them.

4. Post-exploitation impact. The direct result is host file-existence disclosure, which can reveal OS type, application installation paths, presence of configuration files, deployment artifacts, log locations, and backup files. This information supports follow-on attacks: crafting more targeted traversal attempts to read low-sensitivity files, locating secrets-bearing configuration files for a subsequent read primitive, or mapping the environment prior to lateral movement. Because the primitive is read-only (I:N) and limited (C:L), it is best characterized as an information-gathering step rather than a standalone compromise.

It must be stressed: the attacker-side detail beyond the above is not supported by the provided data. The report does not invent function names, API endpoints, or file paths.

Impact Assessment

Business impact is concentrated in information disclosure and reconnaissance enablement. The CVSS base score is 4.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

• Confidentiality (Low): The primary demonstrated impact is determination of file existence outside the intended directory, and potentially limited access to file paths. No evidence of file content exfiltration is provided.
• Integrity (None): The flaw, as described, does not allow modification of files or data.
• Availability (None): No denial-of-service impact is described.
• Scope (Unchanged): Impact remains within the application's authority.
• Privileges (Low) / User Interaction (None): Any authenticated Viewer account suffices, and no victim action is required for the oracle behavior.

Blast radius: All deployments of Satel Netco Design prior to v2.1.7. Because any Viewer-level authenticated account is sufficient, the population of potential abusers is the entire user base of the application, not just administrators. In managed or multi-tenant deployments, this widens the internal threat surface. The EPSS score is not yet available (FIRST.org has not scored this CVE), and the CVE is not listed in CISA KEV — so there is currently no evidence of active exploitation in the wild. The practical risk is elevated in environments where Viewer accounts are broadly provisioned, where credentials are weak or reused, or where the application is exposed beyond a trusted network segment.

Detection Guidance

Sigma Rule

title: Satel Netco Design Relative Path Traversal in Data Import (CVE-2026-105275)
id: d4f1c9a2-7b3e-4c58-9a01-2e6f0c1b7a44
status: experimental
description: Detects relative path traversal sequences (../) submitted to Satel Netco Design data import functionality, consistent with CVE-2026-105275.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105275
author: valtersit.com
date: 2026/01/01
tags:
  - attack.discovery
  - attack.t1083
  - cve.2026-105275
logsource:
  category: webserver
detection:
  selection_method:
    http.method:
      - 'POST'
      - 'GET'
  selection_traversal:
    - cs-uri-query|contains:
        - '../'
        - '..%2f'
        - '..%5c'
        - '%2e%2e%2f'
        - '%2e%2e/'
        - '....//'
        - '..%252f'
  selection_app:
    cs-uri-stem|contains:
      - 'Satel'
      - 'Netco'
  condition: selection_method and selection_traversal and selection_app
falsepositives:
  - Legitimate file paths containing encoded dot sequences
  - Security scanners and fuzzing tools
level: medium

YARA Rule

rule CVE_2026_105275_Satel_Netco_Path_Traversal
{
    meta:
        description = "Detects relative path traversal payloads targeting Satel Netco Design data import (CVE-2026-105275)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105275"
        date = "2026-01-01"
        cve = "CVE-2026-105275"

    strings:
        $t1 = "../" ascii
        $t2 = "..\\" ascii
        $t3 = "%2e%2e%2f" ascii nocase
        $t4 = "%2e%2e/" ascii nocase
        $t5 = "..%2f" ascii nocase
        $t6 = "..%5c" ascii nocase
        $t7 = "....//" ascii
        $app1 = "Satel" ascii nocase
        $app2 = "Netco" ascii nocase
        $imp = "import" ascii nocase

    condition:
        ($app1 or $app2) and $imp and 1 of ($t*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105275 Satel Netco Design Relative Path Traversal in Data Import"; flow:established,to_server; http.method; content:"POST" or content:"GET"; http.uri; content:"../" nocase; http.uri; content:"Satel" nocase; reference:cve,2026-105275; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105275; classtype:attempted-recon; sid:900105275; rev:1;)

alert http any any -> any any (msg:"CVE-2026-105275 Satel Netco Design Encoded Path Traversal Attempt"; flow:established,to_server; http.uri; content:"%2e%2e%2f" nocase; reference:cve,2026-105275; classtype:attempted-recon; sid:900105276; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [ network where http.request.method in ("GET","POST") and
      stringContains(http.request.uri, "Satel") and
      (stringContains(http.request.uri, "../") or
       stringContains(http.request.uri, "..%2f") or
       stringContains(http.request.uri, "%2e%2e%2f") or
       stringContains(http.request.uri, "..%5c")) ]
  [ network where http.response.status_code in (200, 404, 500) and
      stringContains(http.request.uri, "Satel") ]

Splunk SPL Query

index=web sourcetype=access_combined
(http_method=POST OR http_method=GET)
(uri_path="*Satel*" OR uri_path="*Netco*" OR uri_query="*Satel*")
(uri="*../*" OR uri="*..%2f*" OR uri="*%2e%2e%2f*" OR uri="*..%5c*" OR uri="*%2e%2e/*" OR uri="*....//*")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(status) as status_codes
        values(uri) as attempted_uris
        by src_ip, user, uri_path
| where count > 3
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,cve_2026_105275,satel_netco">
  <rule id="100275" level="10">
    <if_sid>31100</if_sid>
    <id>^40[0-9][0-9]$</id>
    <match>Satel|Netco</match>
    <regex>\.\.(/|%2f|%5c)|%2e%2e%2f|%2e%2e/|\.\.\.\.//</regex>
    <description>CVE-2026-105275: Satel Netco Design relative path traversal attempt in data import detected.</description>
    <mitre>
      <id>T1083</id>
    </mitre>
    <group>cve_2026_105275,path_traversal,</group>
  </rule>

  <rule id="100276" level="12" frequency="5" timeframe="120">
    <if_matched_sid>100275</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-105275: Repeated Satel Netco Design path traversal probes from same source (possible file existence enumeration).</description>
    <mitre>
      <id>T1083</id>
    </mitre>
    <group>cve_2026_105275,path_traversal,enumeration,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. No vendor advisory, patch artifact, or workaround is currently tracked. The CVE description references v2.1.7 as the fixed baseline, but this cannot be independently validated through the provided data.

1) Immediate mitigations (until a vendor patch is verified):

• Restrict network exposure of Satel Netco Design to trusted segments; place it behind an authenticated reverse proxy or VPN rather than directly reachable.
• Enforce least privilege: audit Viewer accounts, remove dormant accounts, and reduce the number of low-privileged accounts that can reach the data import functionality.
• Apply strong authentication (MFA where supported) to reduce the credential-reuse path that grants the required Viewer session.
• Monitor and rate-limit repeated path-bearing requests to the import feature; alert on traversal sequences per the detection rules above.
• Where feasible, run the application with minimal OS filesystem permissions and isolate it from sensitive directories, so that a successful traversal yields minimal information.

2) Patch/upgrade steps:

• When a vendor release is available, upgrade to v2.1.7 or later (the version referenced as fixed in the CVE description), verifying authenticity of the artifact against the vendor's official distribution channel.
• Because patch confidence is 0/4, do not assume v2.1.7 fully remediates the issue without confirmation from the vendor's advisory. Track the NVD entry for updates and monitor the vendor's security communication channels.
• After upgrade, re-test the data import path with traversal inputs in a controlled environment to confirm the fix.

3) Long-term hardening:

• Adopt secure path handling: canonicalize all user-supplied paths and validate that the resolved path remains within an allow-listed base directory before use.
• Apply input validation and reject traversal sequences (including encoded variants) at the application boundary.
• Integrate static analysis (targeting CWE-23) into the SDLC and add traversal test cases to QA.
• Enforce a least-privilege filesystem model for the service account running the application.
• Maintain asset inventory so affected Satel Netco Design instances are tracked and promptly updated.

References

• NVD — CVE-2026-105275: https://nvd.nist.gov/vuln/detail/CVE-2026-105275
• CWE-23 — Relative Path Traversal: https://cwe.mitre.org/data/definitions/23.html
• MITRE ATT&CK — T1083 File and Directory Discovery: https://attack.mitre.org/techniques/T1083/
• FIRST.org EPSS (score not yet available for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, Nuclei template, or exploit code is available, and there is currently no evidence of exploit-in-the-wild activity or association with known threat actor campaigns for CVE-2026-105275.