Medium severity · published Feb 10, 2026
CVE-2026-25872
JUNG Smart Panel 5.1 KNX Unauthenticated Path Traversal
5.3
CVSS
0.8%
EPSS
No
On KEV
Description
JUNG Smart Panel KNX firmware version L1.12.22 and prior contain an unauthenticated path traversal vulnerability in the embedded web interface. The application fails to properly validate file path input, allowing remote, unauthenticated attackers to access arbitrary files on the underlying filesystem within the context of the web server. This may result in disclosure of system configuration files and other sensitive information.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
JUNG Smart Panel 5.1 KNX · ALBRECHT JUNG GMBH & CO. KG
through L1.12.22 · source: vendor
Affected product
JS
JUNG Smart Panel 5.1 KNX
ALBRECHT JUNG GMBH & CO. KG
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25872
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25872
downloads.jung.de
https://downloads.jung.de/public/en/pdf/productdocumentation/en_sp5.1knx_09012015.pdf
www.jung-group.com
https://www.jung-group.com/
www.vulncheck.com
https://www.vulncheck.com/advisories/jung-smart-panel-knx-unauthenticated-path-traversal
www.zeroscience.mk
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5969.php