XSS in Ics-Cert Psi Gridconnect Gmbh (Formerly Known As Nentec Gmbh) Telecontrol Gateway And Smart Unit Family, Iec104 Security Proxy.
CVE-2019-6528
PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway XS-MU Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway VM Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Smart Telecontrol Unit TCG Versions 5.0.27, 5.1.19, 6.0.16 and prior, and IEC104 Security Proxy Version 2.2.10 and prior The web application browser interprets input as active HTML, JavaScript, or VBScript, which could allow an attacker to execute arbitrary code.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.026 (84.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 85th percentile — 84.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.026 · newest: 0.026 · change: 0.000
Affected products
- Ics-Cert Psi Gridconnect Gmbh (Formerly Known As Nentec Gmbh) Telecontrol Gateway And Smart Unit Family, Iec104 Security Proxy. — versions Telecontrol Gateway 3G Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway XS-MU Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway VM Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Smart Telecontrol Unit TCG Versions 5.0.27, 5.1.19, 6.0.16 and prior, and IEC104 Security Proxy Version 2.2.10 and prior.
- Psigridconnect Iec104 Security Proxy
- Psigridconnect Iec104 Security Proxy Firmware
- Psigridconnect Smart Telecontrol Unit Tcg
- Psigridconnect Smart Telecontrol Unit Tcg Firmware
- Psigridconnect Telecontrol Gateway 3g
- Psigridconnect Telecontrol Gateway 3g Firmware
- Psigridconnect Telecontrol Gateway Vm
- Psigridconnect Telecontrol Gateway Vm Firmware
- Psigridconnect Telecontrol Gateway Xs-Mu
Weakness classification (CWE)
References
- www.securityfocus.com/bid/107201 (VDB Entry, Third Party Advisory, vdb-entry)
- ics-cert.us-cert.gov/advisories/ICSA-19-059-01 (US Government Resource, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-6528?
- CVE-2019-6528 is a high-severity vulnerability in Ics-Cert Psi Gridconnect Gmbh (Formerly Known As Nentec Gmbh) Telecontrol Gateway And Smart Unit Family, Iec104 Security Proxy., classified under Cross-site Scripting. CVSS score: 8.8/10. Published 2019-03-05.
- How severe is CVE-2019-6528?
- High severity. CVSS v3 base score is 8.8 out of 10.