{"id":"CVE-2026-110970","title":"Lack of traffic encryption in Płatnik","summary":"Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own.\n\n\n\n\nThis issue was fixed in …","severity":"low","cvss":2.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-1428"],"vendor":"Zakład Ubezpieczeń Społecznych","product":"Płatnik","affected":["Płatnik <= 10.02.002"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T15:29:49.098740Z"},"published":"2026-10-30","updated":"2026-11-03","sourceUpdated":"2026-11-03T09:13:02.717Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110970","references":[{"url":"https://cert.pl/posts/2026/10/CVE-2026-110970"},{"url":"https://www.zus.pl/firmy/program-platnik/o-programie-platnik"}],"tags":["cve.org"],"epss":0.00335,"epssPercentile":0.27013,"ingestedAt":"2026-11-05T19:30:42.935Z","slug":"CVE-2026-110970","body":"## Overview\n\nPłatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own.\n\n\n\n\nThis issue was fixed in metric 334 in version 10.02.002.\n\n## Affected\n\n- `Płatnik <= 10.02.002`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":13,"depthScoreParts":{"impact":12.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}