Man-In-The-Middle Vulnerability in Płatnik by ZUS

CVE-2026-110970

What is CVE-2026-110970?

Płatnik, a software developed by ZUS, is vulnerable due to its reliance on the HTTP protocol for downloading updates and support files. This design flaw enables an attacker to execute a Man-In-The-Middle attack, allowing the interception of sensitive data transmitted during the update process. Furthermore, attackers can replace legitimate files with malicious versions, posing a significant risk to users. The vulnerability has been addressed in metric 242 with the release of version 10.02.002.

References