Description
Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own.
This issue was fixed in metric 334 in version 10.02.002.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Zakład Ubezpieczeń Społecznych | Płatnik | ≤ 10.02.002 | — |
References
- https://cert.pl/posts/2026/10/CVE-2026-110970 third-party-advisory
- https://www.zus.pl/firmy/program-platnik/o-programie-platnik product