CVE-2026-25599: Missing Authentication, Clear-Text Transmission and Stored XSS in Orca Heat Pumps and Orca User Portal Threadlinqs Intelligence / 28min Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5213 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise.

SI-CERT advisory for CVE-2026-25599: legacy Orca heat pump terminals (CAREL PGDT04000F020, firmware before 2.1) identify themselves to the Orca control server using only a device ID over unencrypted HTTP, letting an attacker impersonate a device and inject stored XSS into the Orca user portal. First disclosed 2026-04-17 .

Key facts for Orca heat pump spoofing

Detection coverage for Orca heat pump spoofing

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5213 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans .

Free detection: Orca Portal Session Cookie Replay From Multiple Sources

Detects one moja.orca.energy session cookie (hashed, never kept in clear) presented from more than one source IP and more than one user agent within 24h. This is the post-exploitation outcome of CVE-2026-25599 stored XSS: a stolen session cookie replayed by the attacker while the victim stays logged in. Requires TLS-terminating proxy or WAF logs with cookie data.

Languages: Splunk SPL, Microsoft KQL, Sigma

ATT&CK: T1539 , T1185 , T1550.004

Data sources: splunk_stream_http, tls_terminating_proxy, waf_logs

Known false positives:

Users roaming between mobile and Wi-Fi networks with a changed user agent string after a browser update

Corporate proxies or VPN egress pools rotating source IPs mid-session

Tuning notes: Raise the source IP threshold or require different ASNs or countries to cut roaming noise. Exclude known corporate egress pools. The cookie is hashed before aggregation so raw tokens are never retained in results.

🔒 Orca Portal XSS Cookie Exfiltration Callback To Non-Orca Host · unlock with TL Creds

🔒 Vulnerable Orca Legacy Proxy [indicator] Present Or Executed · unlock with TL Creds

🔒 Orca Legacy Proxy Clear-Text HTTP Egress To Control Server · unlock with TL Creds

🔒 Clear-Text HTTP Request To Orca Control Server · unlock with TL Creds

🔒 Script Payload In Request To Orca User Portal · unlock with TL Creds

🔒 Shell Or Script Host Spawned By Orca Legacy Proxy · unlock with TL Creds

🔒 CVE-2026-25599 Orca Device-Channel Script Payload (Stored XSS Injection) · unlock with TL Creds

🔒 Orca Device ID Impersonation - One Device ID From Multiple Sources · unlock with TL Creds

Indicators of compromise for Orca heat pump spoofing

As of 2026-11-04, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5213.

Sample indicators (2 of 11)

Domain: moja[.]orca[.]energy

File hash: 51068e96d5cc21002b618c02bd5853520d73cb6451383e4094a70ea055251d5a

Defanged, TLP:CLEAR. Full set of 11 indicators: unlock with TL Creds .

How Orca heat pump spoofing works

The portal was fixed in version 1.19; no active exploitation or public PoC is reported.

CVE-2026-25599 (CVSS 3.1 base 6.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) combines three weaknesses affecting the Orca heat pump ecosystem operated by Orca Energy: CWE-306 (missing authentication), CWE-319 (clear-text transmission of sensitive information) and CWE-79 (stored cross-site scripting). Per the SI-CERT advisory, legacy terminals transmit only a device ID to the control server, with no additional verification, and do so over plain HTTP on a non-secure port. Because the channel is neither authenticated nor encrypted, a network attacker can impersonate a legitimate device.

The Orca user portal (moja.orca.energy) did not neutralize device-supplied data before rendering it. An attacker posing as a device could therefore inject a script payload that is stored by the backend and executed in the browser of an authenticated portal user, with the advisory describing theft of session cookies from authenticated users as the consequence. NVD describes the impact as compromise of user accounts and exposure of sensitive data; the aggregated CVE record adds that unauthorized access to an Orca account could allow remote control of the associated heat pump, including modification of operational parameters and disruption of operational stability.

Affected: Orca user portal versions before 1.19 (remediated 2026-03-09) and legacy Orca heat pump terminals based on the CAREL P/N PGDT04000F020 (ARM CPU, 256MB DDR2, 128MB flash, Windows CE 6.0) running firmware before 2.1 (NVD records < 2.1.0). Devices older than roughly five years are in scope; terminals with firmware 2.1 or later are not affected. The advisory lists the legacy proxy application OrcaDevNativeProxy.exe with SHA256 51068e96d5cc21002b618c02bd5853520d73cb6451383e4094a70ea055251d5a as the affected binary.

The vendor mitigations on the portal side are backend input validation and sanitization, output encoding of all terminal-provided data, a nonce-based Content Security Policy, and session cookies hardened with HttpOnly, Secure and SameSite=Lax. The issue was reported by Tom Kern (SOC Tech Lead, NIL d.o.o., Slovenia). The advisory states there are no known exploits in circulation and no PoC is published. Legacy terminals cannot gain the portal-side fix, so their clear-text channel remains a residual exposure until the hardware is upgraded or replaced.

MITRE ATT&CK techniques by tactic:

T1040 Network Sniffing ; T1539 Steal Web Session Cookie ; T1557 Adversary-in-the-Middle

T1185 Browser Session Hijacking

T1190 Exploit Public-Facing Application ; T1659 Content Injection

T1565.002 Transmitted Data Manipulation

Remediation for Orca heat pump spoofing

Orca user portal 1.19 (input validation, output encoding, CSP, HttpOnly/Secure/SameSite=Lax cookies)

Orca heat pump terminal firmware 2.1 or later

Confirm Orca user portal is at version 1.19 or later (vendor-hosted fix deployed 2026-03-09)

Identify legacy Orca terminals (CAREL PGDT04000F020) with firmware earlier than 2.1

Monitor for unencrypted HTTP traffic from heat pump terminals to the Orca control server and for device-ID reuse from unexpected sources

Restrict legacy terminal traffic to the vendor control server through firewall allow-listing

Log out of the Orca portal when not in use and rotate account credentials if compromise is suspected

Longer-term hardening

Replace or upgrade legacy terminals to firmware 2.1 or later hardware

Place heat pump terminals on segmented networks and do not expose them to untrusted networks

Use a nonce-based Content Security Policy and output encoding for all device-supplied data in web portals

Affected and fixed versions

Orca Energy — Orca user portal Vulnerable versions: < 1.19 Fixed in: 1.19

Orca Energy — Orca heat pump (legacy CAREL PGDT04000F020 terminal) Vulnerable versions: firmware < 2.1 Fixed in: firmware 2.1 and later

Timeline of Orca heat pump spoofing

2026-01-05 Researcher locked-ioc-10 (locked-ioc-9) makes initial regarding the Orca heat pump vulnerabilities

2026-01-09 Report and vendor notification period begins (January 9-14, 2026 per SI-CERT)

2026-01-14 Vendor notification window closes with the report delivered to the affected parties

2026-03-09 Orca user portal stored XSS fixed (version 1.19) with input validation, output encoding, CSP and hardened session cookies

2026-04-17 SI-CERT publishes the advisory for CVE-2026-25599; no known exploits reported

2026-06-01 CVE-2026-25599 published in NVD with CVSS 3.1 base score 6.3 (Medium)

2026-07-22 NVD record last modified

Sources cited for Orca heat pump spoofing

CVE-2026-25599 - Missing authentication and clear-text data transmission of Orca heat pumps (SI-CERT) cert.si · Advisory · 2026-04-17

NVD - CVE-2026-25599 NVD (NIST) · Advisory · 2026-06-01

NVD CVE API record for CVE-2026-25599 NVD (NIST) · Research · 2026-06-01

PT-2026-45397 Orca Heat Pump (Positive Technologies dbugs) dbugs.ptsecurity.com · Research · 2026-06-01

CVE-2026-25599 (GCVE-0-2026-25599) db.gcve.eu · Research · 2026-06-01

CVE-2026-25599 - CERT Hrvatska CVE record cve.cert.hr · Research · 2026-06-01

CVE-2026-25599 - OpenCVE app.opencve.io · Research · 2026-06-01

Drafted by the Threadlinqs research pipeline from 7 sources; published 2026-11-04 ; last updated —.