PT-2019-12360 · Kalki Kalkitech · Kalki Kalkitech Sync3000 Substation Dcu Gpc

Publicado 2019-05-22 · Atualizado 2020-08-24 · CVE-2019-11536

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Kalki Kalkitech SYNC3000 Substation DCU GPC versions 2.22.6, 2.23.0, 2.24.0, 3.0.0, 3.1.0, 3.1.16, 3.2.3, 3.2.6, 3.5.0, 3.6.0, 3.6.1

Description The issue allows an attacker to inject client-side commands or scripts to be executed on the device with privileged access. This can be done through the webserver interface, typically via a browser, and requires network connectivity to the device.

Recommendations For versions 2.22.6, 2.23.0, 2.24.0, 3.0.0, 3.1.0, 3.1.16, 3.2.3, 3.2.6, 3.5.0, 3.6.0, 3.6.1, consider installing WebHMI to mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2019-11536

Produtos afetados

Kalki Kalkitech Sync3000 Substation Dcu Gpc

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-11536 · Nota de Segurança
• https://kalkitech.com/cybersecurity · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-11536 · Aviso do Fabricante
• https://kalkitech.com/wp-content/uploads/CYB_19561_Advisory.pdf · Aviso do Fabricante