Unencrypted HTTP downloads in Płatnik allow man-in-the-middle attacks
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Płatnik through 10.02.002 from Zakład Ubezpieczeń Społecznych uses HTTP to download updates, libraries and support files. A network attacker in a man-in-the-middle position can read the transmitted data and replace the original files with their own (CWE-1428).
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own. This issue was fixed in metric 334 in version 10.02.002.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Zakład Ubezpieczeń Społecznych | Płatnik | up to 10.02.002 | — | No fix listed | CNA |
- Płatnik VendorZakład Ubezpieczeń Społecznych Affected up to 10.02.002 Fixed in — No fix listed CNA
Remediation
The fix is in metric 334 in version 10.02.002 of Płatnik.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Timeline
- 2026-10-30 Threatist record created from CVE-2026-110970
- 2026-10-30 Alias added: GHSA-28pv-83vg-wwmr
- 2026-10-30 CISA SSVC decision points changed
References
More Zakład Ubezpieczeń Społecznych vulnerabilities
- TI-2026-83041 Client-side authentication in Płatnik allows login as any user CVSS 4.0HIGH 8.6
- TI-2026-83040 Weak password encoding in Płatnik lets users decode passwords CVSS 4.0HIGH 7.7
Sources
- CVE-2026-110970 · CVE Program
- CVE-2026-110970 · NVD
- FIRST EPSS
- GHSA-28pv-83vg-wwmr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences