CVE-2026-19061

LowCVSS 3.7/10Last modified Oct 13, 2026

Description

A flaw has been found in Insta InstaKNXServiceApp 1.2.3.1469. Affected by this issue is the function CreateWebClientAndDownloadFileList of the component Firmware Update Handler. Executing a manipulation can lead to insufficient verification of data authenticity. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitation is known to be difficult. There are still doubts about whether this vulnerability truly exists. The vendor explains: "[T]he entry suggests that the device does not verify the authenticity of the update. This is incorrect. The device performs an authenticity check after the complete update has been transferred. If this check fails, the update is not installed and the previously installed firmware continues to run".

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-345

Affected software

No affected versions have been published.

Timeline

Published
Aug 6, 2026
Last modified
Oct 13, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-190627.3A vulnerability has been found in chiuwingyan house up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670. This affects an unknown part of the fileCVE-2026-190644.3A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0. This vulnerability affects unknown code of CVE-2026-190656.3A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown procesCVE-2026-190664.3A vulnerability was identified in SourceCodester Online Examination & Learning Management System 1.0. Impacted is an unknown function of theCVE-2026-190676.3A security flaw has been discovered in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file CVE-2026-190686.3A weakness has been identified in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /treaCVE-2026-190696.3A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /treCVE-2026-19077.5A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. TCVE-2026-190706.3A vulnerability was detected in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /viewadmin.php. ThCVE-2026-190716.3A flaw has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewappointment.php. ThisCVE-2026-190729.9Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt.CVE-2026-190735.3The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpo
CVE-2026-19061: Low severity, CVSS 3.7 | Vulnix