Lucene search

[email protected]CVE-2019-6528

HistoryMar 05, 2019 - 8:29 p.m.

CVE-2019-6528

2019-03-0520:29:00

CWE-79

[email protected]

web.nvd.nist.gov

information security

cve-2019-6528

psi gridconnect gmbh

telecontrol gateway

iec104 security proxy

arbitrary code execution

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.0%

JSON

PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway XS-MU Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway VM Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Smart Telecontrol Unit TCG Versions 5.0.27, 5.1.19, 6.0.16 and prior, and IEC104 Security Proxy Version 2.2.10 and prior The web application browser interprets input as active HTML, JavaScript, or VBScript, which could allow an attacker to execute arbitrary code.

Affected configurations

NVD

Node

psigridconnecttelecontrol_gateway_xs-mu_firmwareRange<5.1.20

psigridconnecttelecontrol_gateway_xs-mu_firmwareRange5.1.21–6.0.16

AND

psigridconnecttelecontrol_gateway_xs-muMatch-

Node

psigridconnecttelecontrol_gateway_vm_firmwareRange<5.1.20

psigridconnecttelecontrol_gateway_vm_firmwareRange5.1.21–6.0.16

AND

psigridconnecttelecontrol_gateway_vmMatch-

Node

psigridconnecttelecontrol_gateway_3g_firmwareRange<5.1.20

psigridconnecttelecontrol_gateway_3g_firmwareRange5.1.21–6.0.16

AND

psigridconnecttelecontrol_gateway_3gMatch-

Node

psigridconnectsmart_telecontrol_unit_tcgMatch-

AND

psigridconnectsmart_telecontrol_unit_tcg_firmwareRange<5.1.20

psigridconnectsmart_telecontrol_unit_tcg_firmwareRange5.1.21–6.0.16

Node

psigridconnectiec104_security_proxyMatch-

AND

psigridconnectiec104_security_proxy_firmwareRange≤2.2.10

CPENameOperatorVersion
psigridconnect:telecontrol_gateway_xs-mu_firmwarepsigridconnect telecontrol gateway xs-mu firmwarelt5.1.20
psigridconnect:telecontrol_gateway_xs-mu_firmwarepsigridconnect telecontrol gateway xs-mu firmwarele6.0.16

CPE	Name	Operator	Version
psigridconnect:telecontrol_gateway_xs-mu_firmware	psigridconnect telecontrol gateway xs-mu firmware	lt	5.1.20
psigridconnect:telecontrol_gateway_xs-mu_firmware	psigridconnect telecontrol gateway xs-mu firmware	le	6.0.16

CNA Affected

[
  {
    "product": "PSI GridConnect GmbH (formerly known as PSI Nentec GmbH) Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy.",
    "vendor": "ICS-CERT",
    "versions": [
      {
        "status": "affected",
        "version": "Telecontrol Gateway 3G Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway XS-MU Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway VM Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Smart Telecontrol Unit TCG Versions 5.0.27, 5.1.19, 6.0.16 and prior, and IEC104 Security Proxy Version 2.2.10 and prior."
      }
    ]
  }
]

References

www.securityfocus.com/bid/107201

ics-cert.us-cert.gov/advisories/ICSA-19-059-01

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.0%

JSON

Related for CVE-2019-6528

cvelist1 ics1 nvd1 prion1