Medium 5.3Published May 20, 2026

CVE-2026-4293Kieback & Peter DDC Building Controllers Cross-site Scripting

Updated under an hour ago (Oct 26, 2026, 1:30 PM ET)

Does this affect you?

It affects Kieback & Peter DDC4002 and 10 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Kieback & Peter DDC4002

Exploited in the last 30 days

The affected Kieback & Peter DDC building controllers are vulnerable to cross-site scripting, enabling JavaScript to be executed by the victim's browser, which allows the attacker to control the browser.

CVSS: 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness (CWE): CWE-79
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: icscert
NVD analysis: Deferred
Record last updated: May 20, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Kieback & Peter DDC4002 kieback_and_peter:ddc4002 (from the name)	through 1.12.14	CNA record
Kieback & Peter DDC4100 kieback_and_peter:ddc4100 (from the name)	through 1.12.14	CNA record
Kieback & Peter DDC4200 kieback_and_peter:ddc4200 (from the name)	through 1.12.14	CNA record
Kieback & Peter DDC4200-L kieback_and_peter:ddc4200_l (from the name)	through 1.12.14	CNA record
Kieback & Peter DDC4400 kieback_and_peter:ddc4400 (from the name)	through 1.12.14	CNA record
Kieback & Peter DDC4002e kieback_and_peter:ddc4002e (from the name)	through 1.23.4	CNA record
Kieback & Peter DDC4200e kieback_and_peter:ddc4200e (from the name)	through 1.23.4	CNA record
Kieback & Peter DDC4400e kieback_and_peter:ddc4400e (from the name)	through 1.23.4	CNA record
Kieback & Peter DDC4020e kieback_and_peter:ddc4020e (from the name)	through 1.23.4	CNA record
Kieback & Peter DDC4040e kieback_and_peter:ddc4040e (from the name)	through 1.23.4	CNA record
1–10 of 11

References

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-139-05
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-139-05.json

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.