CVE-2019-6528
Description
PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway XS-MU Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway VM Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Smart Telecontrol Unit TCG Versions 5.0.27, 5.1.19, 6.0.16 and prior, and IEC104 Security Proxy Version 2.2.10 and prior The web application browser interprets input as active HTML, JavaScript, or VBScript, which could allow an attacker to execute arbitrary code.
How to fix
- psigridconnect telecontrol_gateway_xs-mu_firmware5.1.20 or later
- psigridconnect telecontrol_gateway_vm_firmware5.1.20 or later
- psigridconnect telecontrol_gateway_3g_firmware5.1.20, 6.0.16 or later
- psigridconnect smart_telecontrol_unit_tcg_firmware5.1.20, 6.0.16 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| psigridconnect telecontrol_gateway_xs-mu_firmware | v < 5.1.20, 5.1.21 ≤ v ≤ 6.0.16 | 5.1.20 |
| psigridconnect telecontrol_gateway_vm_firmware | v < 5.1.20, 5.1.21 ≤ v ≤ 6.0.16 | 5.1.20 |
| psigridconnect telecontrol_gateway_3g_firmware | v < 5.1.20, 5.1.21 ≤ v < 6.0.16 | 5.1.20, 6.0.16 |
| psigridconnect smart_telecontrol_unit_tcg_firmware | v < 5.1.20, 5.1.21 ≤ v < 6.0.16 | 5.1.20, 6.0.16 |
| psigridconnect iec104_security_proxy_firmware | v ≤ 2.2.10 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.