✕
Request a Demo
Rewterz
Rewterz Threat Alert- Flawed Ammyy RAT (aka FlawedAmmyy RAT) Malware – Threat Indicators
March 7, 2019
Rewterz
Rewterz Threat Advisory – Cisco Nexus 5600 / 6000 Series Switches NX-OS FCoE Denial of Service Vulnerability
March 7, 2019

Rewterz Threat Advisory – CVE-2019-6528 – Cross-site Scripting Vulnerability due to Improper Neutralization of Input

Severity

High

Analysis Summary

The vulnerability exists due to improper neutralization of input during web page generation process. The web application browser interprets input as active HTML, JavaScript, or VBScript, which could allow an attacker to execute arbitrary code.

Affected Vendors

PSI GridConnect GmbH

Affected Products

Telecontrol Gateway and Smart Telecontrol Unit family
IEC104 Security Proxy
Telecontrol Gateway 3G Versions 4.2.21
5.0.27
5.1.19
6.0.16 and prior;
Telecontrol Gateway XS-MU Versions 4.2.21
Telecontrol Gateway VM Versions 4.2.21
Smart Telecontrol Unit TCG Versions 5.0.27
6.0.16 and prior; and
IEC104 Security Proxy Version 2.2.10 and prior.

Remediation

A fix for the vulnerability is available in the following software releases:

  • 5.1.20,
  • 6.0.17, and
  • IEC104 Security Proxy Version 2.2.11

The following software releases are no longer supported:

  • 4.2.x, and
  • 5.0.x

PSI recommends deactivating the webserver via CLI since the web interface is not essential to the configuration of the device.