CVE-2019-6528: ics-cert psi gridconnect gmbh (formerly known as psi nentec gmbh) telecontrol gateway and smart telecontrol unit family, iec104 security proxy. Cross-site Scripting
Vulnerability summary
CVE-2019-6528 is a high (CVSS 8.8) Cross-site Scripting vulnerability in ics-cert psi gridconnect gmbh (formerly known as psi nentec gmbh) telecontrol gateway and smart telecontrol unit family, iec104 security proxy.. EPSS estimates a 2.58% chance of exploitation in the next 30 days, higher than 85% of scored vulnerabilities.
Timeline
- 05-03-2019PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway XS-MU Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway VM Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Smart Telecontrol Unit TCG Versions 5.0.27, 5.1.19, 6.0.16 and prior, and IEC104 Security Proxy Version 2.2.10 and prior The web application browser interprets input as active HTML, JavaScript, or VBScript, which could allow an attacker to execute arbitrary code.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.58%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
0.00 pp
From 2.58% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Psigridconnect5 products
- iec104_security_proxy_firmware≤ 2.2.10
- smart_telecontrol_unit_tcg_firmware< 5.1.20 | ≥ 5.1.21, < 6.0.16
- telecontrol_gateway_3g_firmware< 5.1.20 | ≥ 5.1.21, < 6.0.16
- telecontrol_gateway_vm_firmware< 5.1.20 | ≥ 5.1.21, ≤ 6.0.16
- telecontrol_gateway_xs-mu_firmware< 5.1.20 | ≥ 5.1.21, ≤ 6.0.16
Ics-cert1 product
- psi gridconnect gmbh (formerly known as psi nentec gmbh) telecontrol gateway and smart telecontrol unit family, iec104 security proxy.Telecontrol Gateway 3G Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway XS-MU Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway VM Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Smart Telecontrol Unit TCG Versions 5.0.27, 5.1.19, 6.0.16 and prior, and IEC104 Security Proxy Version 2.2.10 and prior.
2 vendors · 6 products
References
2 links- ics-cert.us-cert.gov/advisories/ICSA-19-059-01X Refsource MISCThird Party AdvisoryUS Government Resource