CVE-2019-11536

Published May 22, 2019

Last updated 4 years ago

Overview

Description: Kalki Kalkitech SYNC3000 Substation DCU GPC v2.22.6, 2.23.0, 2.24.0, 3.0.0, 3.1.0, 3.1.16, 3.2.3, 3.2.6, 3.5.0, 3.6.0, and 3.6.1, when WebHMI is not installed, allows an attacker to inject client-side commands or scripts to be executed on the device with privileged access, aka CYB/2019/19561. The attack requires network connectivity to the device and exploits the webserver interface, typically through a browser.
Source: cve@mitre.org
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 3.0

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

CVSS 2.0

Type: Primary
Base score: 10
Impact score: 10
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:C/I:C/A:C

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:kalkitech:sync3000:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "D871456C-B80B-4D6B-93E0-4BD87F80141E"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:kalkitech:sync3000_firmware:2.22.6:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DCB00F5A-F9D5-41E8-877E-92CDA8308560"
          },
          {
            "criteria": "cpe:2.3:o:kalkitech:sync3000_firmware:2.23.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C5FF6A57-74BE-47B5-87C3-6D9446D4BA4F"
          },
          {
            "criteria": "cpe:2.3:o:kalkitech:sync3000_firmware:2.24.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F2B79022-7CF7-4676-979D-AB5E1C284A1C"
          },
          {
            "criteria": "cpe:2.3:o:kalkitech:sync3000_firmware:3.0.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B61F7362-90D4-4A9E-9816-DDEA136A81C7"
          },
          {
            "criteria": "cpe:2.3:o:kalkitech:sync3000_firmware:3.1.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EC382AB4-76BF-4EB7-8926-A30C1EB628C9"
          },
          {
            "criteria": "cpe:2.3:o:kalkitech:sync3000_firmware:3.1.16:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2F6FC17B-061B-41BF-8681-D598486A1DE4"
          },
          {
            "criteria": "cpe:2.3:o:kalkitech:sync3000_firmware:3.2.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2FF26B0C-70F8-45D6-BF58-482CD5506663"
          },
          {
            "criteria": "cpe:2.3:o:kalkitech:sync3000_firmware:3.2.6:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B91FB77E-6830-4BD5-A082-3762AD4259DF"
          },
          {
            "criteria": "cpe:2.3:o:kalkitech:sync3000_firmware:3.5.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3C104E84-AFDD-4CF6-9407-E75419BFF78B"
          },
          {
            "criteria": "cpe:2.3:o:kalkitech:sync3000_firmware:3.6.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "67A4FC87-0D08-46E9-B9A2-CA42B4FA0D6B"
          },
          {
            "criteria": "cpe:2.3:o:kalkitech:sync3000_firmware:3.6.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0617B24A-9FA0-46DE-8887-2113D387EC87"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

Overview

Social media

Risk scores

CVSS 3.0

CVSS 2.0

Weaknesses

Configurations

References