XSS in Ics-Cert Psi Gridconnect Gmbh (Formerly Known As Nentec Gmbh) Telecontrol Gateway And Smart Unit Family, Iec104 Security Proxy.
CVE-2019-6528
PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway XS-MU Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway VM Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Smart Telecontrol Unit TCG Versions 5.0.27, 5.1.19, 6.0.16 and prior, and IEC104 Security Proxy Version 2.2.10 and prior The web application browser interprets input as active HTML, JavaScript, or VBScript, which could allow an attacker to execute arbitrary code.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.026 (83.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Ics-cert Psi Gridconnect Gmbh (Formerly Known As Nentec Gmbh) Telecontrol Gateway And Smart Unit Family, Iec104 Security Proxy. — versions Telecontrol Gateway 3G Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway XS-MU Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway VM Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Smart Telecontrol Unit TCG Versions 5.0.27, 5.1.19, 6.0.16 and prior, and IEC104 Security Proxy Version 2.2.10 and prior.
- Psigridconnect Iec104_security_proxy
- Psigridconnect Iec104_security_proxy_firmware
- Psigridconnect Smart_telecontrol_unit_tcg
- Psigridconnect Smart_telecontrol_unit_tcg_firmware
- Psigridconnect Telecontrol_gateway_3g
- Psigridconnect Telecontrol_gateway_3g_firmware
- Psigridconnect Telecontrol_gateway_vm
- Psigridconnect Telecontrol_gateway_vm_firmware
- Psigridconnect Telecontrol_gateway_xs-mu
Weakness classification (CWE)
References
- ics-cert@hq.dhs.gov (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2019-6528?
- CVE-2019-6528 is a high-severity vulnerability in Ics-Cert Psi Gridconnect Gmbh (Formerly Known As Nentec Gmbh) Telecontrol Gateway And Smart Unit Family, Iec104 Security Proxy., classified under Cross-site Scripting. CVSS score: 8.8/10. Published 2019-03-05.
- How severe is CVE-2019-6528?
- High severity. CVSS v3 base score is 8.8 out of 10.