Executive brief
Orca Energy heat pumps and their associated web management portal were found to have security flaws in how they communicate and handle data. Attackers could impersonate older heat pump devices to inject malicious code into the management portal used by customers. If exploited, this could allow an attacker to hijack user sessions, steal account information, and potentially gain remote control over a customer's heating system, leading to service disruptions or increased energy costs.
Technical details
The vulnerability stems from three primary weaknesses: missing authentication (CWE-306), clear-text transmission (CWE-319), and improper input neutralization (CWE-79). Legacy Orca heat pump terminals (running firmware < 2.1) communicate with the backend server via unencrypted HTTP using only a device ID for identification. An attacker can spoof these IDs to send arbitrary data to the Orca backend. Because the Orca User Portal (prior to version 1.19) failed to validate or sanitize this aggregated data, the spoofed data could contain malicious JavaScript. When a legitimate user views their device status in the portal, the script executes in their browser, potentially allowing for session cookie theft and account takeover. The portal has been patched in version 1.19, and legacy devices are now isolated on dedicated server environments.
Affected products
- Orca Energy User Portal prior to 1.19
- Orca Energy Heat Pump Terminal (Legacy) prior to 2.1
Timeline
- 2026-04-17: advisory: Initial advisory published by SI-CERT
- 2026-06-01: disclosed: CVE published to NVD