CVE-2019-11536 - Kalki Kalkitech SYNC3000 Substation DCU GPC v2.22.6, 2.23.0, 2.24.0, 3.0.0, 3.1.0, 3.1.16, 3.2.3, 3.2.6, 3.5.0, 3.6.0, and 3.6.1, when WebHMI is not installed, allows an attacker to inject client-side commands or scripts to be executed on the device with privileged access, aka CYB/2019/19561

Back Back to CVE browser

CRITICAL

Kalki Kalkitech SYNC3000 Substation DCU GPC v2.22.6, 2.23.0, 2.24.0, 3.0.0, 3.1.0, 3.1.16, 3.2.3, 3.2.6, 3.5.0, 3.6.0, and 3.6.1, when WebHMI is not installed, allows an attacker to inject client-side commands or scripts to be executed on the device with privileged access, aka CYB/2019/19561

Published May 22, 2019

9.8

CRITICAL

CVSS 3.0

EPSS 1.90%

Description

Kalki Kalkitech SYNC3000 Substation DCU GPC v2.22.6, 2.23.0, 2.24.0, 3.0.0, 3.1.0, 3.1.16, 3.2.3, 3.2.6, 3.5.0, 3.6.0, and 3.6.1, when WebHMI is not installed, allows an attacker to inject client-side commands or scripts to be executed on the device with privileged access, aka CYB/2019/19561. The attack requires network connectivity to the device and exploits the webserver interface, typically through a browser.

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3207
Advisory
https://www.kalkitech.com/cybersecurity/
x_refsource_MISCVendor Advisory
https://www.kalkitech.com/wp-content/uploads/CYB_19561_Advisory.pdf
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3207		Advisory
https://www.kalkitech.com/cybersecurity/		x_refsource_MISCVendor Advisory
https://www.kalkitech.com/wp-content/uploads/CYB_19561_Advisory.pdf		x_refsource_MISCVendor Advisory