Lucene search

IcscertCVE-2019-6528

HistoryMar 05, 2019 - 9:00 p.m.

CVE-2019-6528

2019-03-0521:00:00

CWE-79

icscert

web.nvd.nist.gov

information security

cve-2019-6528

psi gridconnect gmbh

telecontrol gateway

iec104 security proxy

arbitrary code execution

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

42.1%

JSON

PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway XS-MU Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway VM Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Smart Telecontrol Unit TCG Versions 5.0.27, 5.1.19, 6.0.16 and prior, and IEC104 Security Proxy Version 2.2.10 and prior The web application browser interprets input as active HTML, JavaScript, or VBScript, which could allow an attacker to execute arbitrary code.

Affected configurations

Nvd

Node

psigridconnecttelecontrol_gateway_xs-mu_firmwareRange<5.1.20

psigridconnecttelecontrol_gateway_xs-mu_firmwareRange5.1.21–6.0.16

AND

psigridconnecttelecontrol_gateway_xs-muMatch-

Node

psigridconnecttelecontrol_gateway_vm_firmwareRange<5.1.20

psigridconnecttelecontrol_gateway_vm_firmwareRange5.1.21–6.0.16

AND

psigridconnecttelecontrol_gateway_vmMatch-

Node

psigridconnecttelecontrol_gateway_3g_firmwareRange<5.1.20

psigridconnecttelecontrol_gateway_3g_firmwareRange5.1.21–6.0.16

AND

psigridconnecttelecontrol_gateway_3gMatch-

Node

psigridconnectsmart_telecontrol_unit_tcgMatch-

AND

psigridconnectsmart_telecontrol_unit_tcg_firmwareRange<5.1.20

psigridconnectsmart_telecontrol_unit_tcg_firmwareRange5.1.21–6.0.16

Node

psigridconnectiec104_security_proxyMatch-

AND

psigridconnectiec104_security_proxy_firmwareRange≤2.2.10

VendorProductVersionCPE
psigridconnecttelecontrol_gateway_xs-mu_firmware*cpe:2.3:o:psigridconnect:telecontrol_gateway_xs-mu_firmware:*:*:*:*:*:*:*:*
psigridconnecttelecontrol_gateway_xs-mu-cpe:2.3:h:psigridconnect:telecontrol_gateway_xs-mu:-:*:*:*:*:*:*:*
psigridconnecttelecontrol_gateway_vm_firmware*cpe:2.3:o:psigridconnect:telecontrol_gateway_vm_firmware:*:*:*:*:*:*:*:*
psigridconnecttelecontrol_gateway_vm-cpe:2.3:h:psigridconnect:telecontrol_gateway_vm:-:*:*:*:*:*:*:*
psigridconnecttelecontrol_gateway_3g_firmware*cpe:2.3:o:psigridconnect:telecontrol_gateway_3g_firmware:*:*:*:*:*:*:*:*
psigridconnecttelecontrol_gateway_3g-cpe:2.3:h:psigridconnect:telecontrol_gateway_3g:-:*:*:*:*:*:*:*
psigridconnectsmart_telecontrol_unit_tcg-cpe:2.3:h:psigridconnect:smart_telecontrol_unit_tcg:-:*:*:*:*:*:*:*
psigridconnectsmart_telecontrol_unit_tcg_firmware*cpe:2.3:o:psigridconnect:smart_telecontrol_unit_tcg_firmware:*:*:*:*:*:*:*:*
psigridconnectiec104_security_proxy-cpe:2.3:h:psigridconnect:iec104_security_proxy:-:*:*:*:*:*:*:*
psigridconnectiec104_security_proxy_firmware*cpe:2.3:o:psigridconnect:iec104_security_proxy_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
psigridconnect	telecontrol_gateway_xs-mu_firmware	*	cpe:2.3:o:psigridconnect:telecontrol_gateway_xs-mu_firmware::::::::
psigridconnect	telecontrol_gateway_xs-mu	-	cpe:2.3:h:psigridconnect:telecontrol_gateway_xs-mu:-:::::::*
psigridconnect	telecontrol_gateway_vm_firmware	*	cpe:2.3:o:psigridconnect:telecontrol_gateway_vm_firmware::::::::
psigridconnect	telecontrol_gateway_vm	-	cpe:2.3:h:psigridconnect:telecontrol_gateway_vm:-:::::::*
psigridconnect	telecontrol_gateway_3g_firmware	*	cpe:2.3:o:psigridconnect:telecontrol_gateway_3g_firmware::::::::
psigridconnect	telecontrol_gateway_3g	-	cpe:2.3:h:psigridconnect:telecontrol_gateway_3g:-:::::::*
psigridconnect	smart_telecontrol_unit_tcg	-	cpe:2.3:h:psigridconnect:smart_telecontrol_unit_tcg:-:::::::*
psigridconnect	smart_telecontrol_unit_tcg_firmware	*	cpe:2.3:o:psigridconnect:smart_telecontrol_unit_tcg_firmware::::::::
psigridconnect	iec104_security_proxy	-	cpe:2.3:h:psigridconnect:iec104_security_proxy:-:::::::*
psigridconnect	iec104_security_proxy_firmware	*	cpe:2.3:o:psigridconnect:iec104_security_proxy_firmware::::::::

CNA Affected

[
  {
    "product": "PSI GridConnect GmbH (formerly known as PSI Nentec GmbH) Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy.",
    "vendor": "ICS-CERT",
    "versions": [
      {
        "status": "affected",
        "version": "Telecontrol Gateway 3G Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway XS-MU Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway VM Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Smart Telecontrol Unit TCG Versions 5.0.27, 5.1.19, 6.0.16 and prior, and IEC104 Security Proxy Version 2.2.10 and prior."
      }
    ]
  }
]

References

www.securityfocus.com/bid/107201

ics-cert.us-cert.gov/advisories/ICSA-19-059-01

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

42.1%

JSON

Related for CVE-2019-6528