noindex and left out of the sitemap until more data is confirmed.CVE-2026-101024 is a relative path traversal flaw in the data export feature of Satel Iberia's Satel Netco Design that lets an authenticated Viewer-level user write files outside the intended export directory, potentially leading to unauthorized file creation, modification or arbitrary code execution; NVD has not yet completed its own CVSS scoring or CPE mapping, so this page stays noindex until that analysis is published.
Vulnerability summary
N/A
Not yet scored
0.4%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-08
Published
Vulnerability ID: CVE-2026-101024 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Satel Netco Design | — | before v2.1.7 (fixed in v2.1.7); not yet a published NVD CPE applicability statement |
What this means
CVE-2026-101024 is a relative path traversal vulnerability (CWE-23) in the data export functionality of Satel Netco Design, a network configuration/management product from Satel Iberia. CISA's advisory states the product "contains a relative path traversal vulnerability in its data export functionality," and that "successful exploitation could result in unauthorized file creation or modification and, under certain conditions, arbitrary code execution" (CISA ICS Advisory ICSA-26-281-03). NVD's own description adds that the flaw is reachable by "authenticated users with Viewer privileges," who could write content to filesystem locations accessible by the application service (NVD).
NVD tracks the CVE with status "Awaiting Analysis" as of 2026-10-27: it records a CNA-submitted (ICS-CERT) CVSS v3.1 score of 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and a CVSS v4.0 score of 8.7 (high), but NVD has not published its own independent score or a CPE applicability statement, so this page leaves cvss_score unset rather than presenting the CNA figure as NVD-confirmed (NVD).
CISA's advisory ICSA-26-281-03, published 2026-10-08, confirms Satel Netco Design before v2.1.7 is affected and fixed in v2.1.7, credits researcher Alex Williams of Pellera Technologies with the report, and discloses three further flaws in the same release: CVE-2026-105269 (stored XSS via Network Operator privileges), CVE-2026-104628 (regex denial-of-service from crafted search input) and CVE-2026-105275 (path traversal in the data import path, enabling file enumeration). CISA states no known public exploitation of any of these four vulnerabilities has been reported to it at this time (CISA ICS Advisory ICSA-26-281-03).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-26, and FIRST scores the probability of exploitation at 0.00436 (37.6th percentile) as of 2026-10-26 (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity and applicability analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, Satel Netco Design operators should update to v2.1.7 or later, which also addresses the three related CVEs disclosed in the same advisory.
Evidence
- Relative path traversal in the data export function lets an authenticated Viewer-privilege user write files outside the intended export directory, risking unauthorized file creation/modification or code execution (CWE-23). — CISA ICS Advisory ICSA-26-281-03
- NVD status is "Awaiting Analysis" with a CNA (ICS-CERT) submitted CVSS v3.1 8.8 / v4.0 8.7, no NVD-published score or CPE configuration as of 2026-10-27. — NVD
- Affects Satel Netco Design before v2.1.7, fixed in v2.1.7; reported by Alex Williams of Pellera Technologies; same advisory discloses 3 related CVEs (CVE-2026-105269, -104628, -105275); no known public exploitation reported. — CISA ICS Advisory ICSA-26-281-03
- Not present in the CISA KEV catalog as of 2026-10-26. — CISA KEV
- EPSS score is 0.00436 (37.6th percentile) as of 2026-10-26. — FIRST EPSS
