VulnerabilityModified

CVE-2019-6528

HIGH 8.8EPSS 2.58%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.58%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway XS-MU Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway VM Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Smart Telecontrol Unit TCG Versions 5.0.27, 5.1.19, 6.0.16 and prior, and IEC104 Security Proxy Version 2.2.10 and prior The web application browser interprets input as active HTML, JavaScript, or VBScript, which could allow an attacker to execute arbitrary code.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 2.58% probability · 85th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-79
Affected: psigridconnect/telecontrol gateway xs-mu firmware · psigridconnect/telecontrol gateway vm firmware · psigridconnect/telecontrol gateway 3g firmware · psigridconnect/smart telecontrol unit tcg firmware · psigridconnect/iec104 security proxy firmware
Source: ics-cert@hq.dhs.gov

EPSS trend

EPSS 2.6% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

http://www.securityfocus.com/bid/107201Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-059-01Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/107201Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-059-01Third Party Advisory, US Government Resource

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.