Description
The affected Kieback & Peter DDC building controllers are vulnerable to cross-site scripting, enabling JavaScript to be executed by the victim's browser, which allows the attacker to control the browser.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kieback & Peter | DDC4002 | ≤ 1.12.14 | — |
| Kieback & Peter | DDC4100 | ≤ 1.12.14 | — |
| Kieback & Peter | DDC4200 | ≤ 1.12.14 | — |
| Kieback & Peter | DDC4200-L | ≤ 1.12.14 | — |
| Kieback & Peter | DDC4400 | ≤ 1.12.14 | — |
| Kieback & Peter | DDC4002e | ≤ 1.23.4 | — |
| Kieback & Peter | DDC4200e | ≤ 1.23.4 | — |
| Kieback & Peter | DDC4400e | ≤ 1.23.4 | — |
| Kieback & Peter | DDC4020e | ≤ 1.23.4 | — |
| Kieback & Peter | DDC4040e | ≤ 1.23.4 | — |
| Kieback & Peter | DDC520 | ≤ 1.24.1 | — |
Advisories 1
- ICSA-26-139-05 Kieback & Peter DDC Building Controllers CISA ICS & IT advisories · May 19, 2026