Customer notice
30 October 2026

Our reference: QCA-25591
CVE: CVE-2026-111497

Letter in PDF

Dear Customer,

Vaisala has identified a security vulnerability in the web user interface of Vaisala Indigo500 transmitters, models INDIGO510 and INDIGO520. The vulnerability affects software versions 1.19.0 through 2.2.0.

Based on Vaisala’s current assessment, this vulnerability could be exploited only if the transmitter’s web user interface can be reached over a network. Software version 2.2.1 fixes this vulnerability. Please update the affected transmitters to this version.

Vaisala recommends updating all transmitters running software versions 1.19.0 through 2.2.0, including those not currently connected to a network, as they may be connected later, for example for service or configuration.

Issue details

A security vulnerability has been identified in a third-party software component used in the Indigo500 web user interface. The vulnerability could allow an unauthorized person with access to the same network to view or change device settings or data. The vulnerability has a CVSS 4.0 score of 9.2.

Your transmitter could be exposed if both of the following are true:

• It runs software version 1.19.0 through 2.2.0.
• Its web user interface can be reached over a network.

The software version determines whether your transmitter is exposed, not its purchase date. For example, a transmitter purchased before March 2025 should be updated if its software has been updated to version 1.19.0 through 2.2.0.

What should you do?

1. Check the software version

• If the transmitter has a display, open the menu and select:  
  Transmitter → About Device
• If the transmitter does not have a display, connect to the web user interface and select: 
  Transmitter → Software

2. Update the transmitter to software version 2.2.1  

Download the software update from the Indigo500 software download page on vaisala.com 

Install the update through the web user interface using the standard update procedure. Perform the update on a controlled, trusted network or through a direct local connection. 

Vaisala recommends keeping the transmitter software always up to date with the latest security updates.

Please note that the software version 2.2.1 contains security fixes only. It does not change the transmitter’s measurement functions or settings. 

Technical support  

If you have any questions or require assistance with the software update, please contact Vaisala Technical Support at [email protected]. Please quote the reference QCA-25591 when contacting us.

Thank you for your attention to this security update. 

Best regards,

Eugenio Da Silva Neto
Product Manager, Industrial Measurements, Vaisala Oyj 
 

Additional information: 
Release notes  
Installation instructions in the User Guide
Letter in PDF