PT-2019-12360 · Kalki Kalkitech · Kalki Kalkitech Sync3000 Substation Dcu Gpc

Published 2019-05-22 · Updated 2020-08-24 · CVE-2019-11536

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Kalki Kalkitech SYNC3000 Substation DCU GPC versions 2.22.6, 2.23.0, 2.24.0, 3.0.0, 3.1.0, 3.1.16, 3.2.3, 3.2.6, 3.5.0, 3.6.0, 3.6.1

Description The issue allows an attacker to inject client-side commands or scripts to be executed on the device with privileged access. This can be done through the webserver interface, typically via a browser, and requires network connectivity to the device.

Recommendations For versions 2.22.6, 2.23.0, 2.24.0, 3.0.0, 3.1.0, 3.1.16, 3.2.3, 3.2.6, 3.5.0, 3.6.0, 3.6.1, consider installing WebHMI to mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2019-11536

Affected Products

Kalki Kalkitech Sync3000 Substation Dcu Gpc

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-11536 · Security Note
• https://kalkitech.com/cybersecurity · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11536 · Vendor Advisory
• https://kalkitech.com/wp-content/uploads/CYB_19561_Advisory.pdf · Vendor Advisory