Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.3

InstaKNXServiceApp may accept unverified firmware updates

CVE-2026-19061 · published 3 months ago
Summary

The InstaKNXServiceApp version 1.2.3.1469 can skip checking the authenticity of firmware files while they are being downloaded. This could allow a remote attacker to feed tampered update data, although the product does perform a final check before installing. Keep the software updated and verify that any firmware comes from a trusted source; consider adding network protections to block unauthorized update traffic.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
insta instaknxserviceapp 1.2.3.1469
Original advisory text
Insta InstaKNXServiceApp Firmware Update CreateWebClientAndDownloadFileList data authenticity
A flaw has been found in Insta InstaKNXServiceApp 1.2.3.1469. Affected by this issue is the function CreateWebClientAndDownloadFileList of the component Firmware Update Handler. Executing a manipulation can lead to insufficient verification of data authenticity. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitation is known to be difficult. There are still doubts about whether this vulnerability truly exists. The vendor explains: "[T]he entry suggests that the device does not verify the authenticity of the update. This is incorrect. The device performs an authenticity check after the complete update has been transferred. If this check fails, the update is not installed and the previously installed firmware continues to run".
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-345Insufficient Verification of Data Authenticity
Timeline
Published6 Aug 2026
Updated29 Oct 2026
First seen6 Aug 2026
Sources
CVE-2026-19061 · NVD
CVE-2026-19061 · MITRE
Track software like this
Free during beta