Search
Find a vulnerability
Search criteria
6 vulnerabilities by kalkitech
CVE-2026-90647 (GCVE-0-2026-90647)
Vulnerability from nvd – Published: 2026-09-12 22:38 – Updated: 2026-09-15 17:10
VLAI
EPSS
VEX
Summary
ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client (Task Mode). This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneous faults, enabling a Man-in-the-Middle attack on protected communications.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 17:09 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ase-systems.com/wp-content/uploads/20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Kalkitech | ASE2000 V2 Communication Test Set |
Affected:
2.35 , < 2.38
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90647",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T17:09:34.244525Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T17:10:28.897Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "ASE2000 V2 Communication Test Set",
"vendor": "Kalkitech",
"versions": [
{
"lessThan": "2.38",
"status": "affected",
"version": "2.35",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client (Task Mode). This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneous faults, enabling a Man-in-the-Middle attack on protected communications."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-12T22:38:16.637Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ase-systems.com/wp-content/uploads/2026/07/CYB_2026_86278_Advisory_v1.0.pdf"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-90647",
"datePublished": "2026-09-12T22:38:16.637Z",
"dateReserved": "2026-09-12T22:28:32.772Z",
"dateUpdated": "2026-09-15T17:10:28.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-36059 (GCVE-0-2024-36059)
Vulnerability from nvd – Published: 2024-06-27 00:00 – Updated: 2024-08-02 03:30
VLAI
EPSS
VEX
Summary
Directory Traversal vulnerability in Kalkitech ASE ASE61850 IEDSmart upto and including version 2.3.5 allows attackers to read/write arbitrary files via the IEC61850 File Transfer protocol.
Severity
9.4 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-09 15:38 UTC
CWE
- n/a
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kalkitech | ase61850_iedsmart |
Affected:
0 , ≤ 2.3.5
(custom)
cpe:2.3:o:kalkitech:ase61850_iedsmart:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:kalkitech:ase61850_iedsmart:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ase61850_iedsmart",
"vendor": "kalkitech",
"versions": [
{
"lessThanOrEqual": "2.3.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-36059",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-09T15:38:38.992124Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-09T15:46:21.623Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:30:13.119Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://kalkitech.com/wp-content/uploads/2024/05/CYB_60704_Advisory_v1.0.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Directory Traversal vulnerability in Kalkitech ASE ASE61850 IEDSmart upto and including version 2.3.5 allows attackers to read/write arbitrary files via the IEC61850 File Transfer protocol."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-27T21:43:42.247Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://kalkitech.com/wp-content/uploads/2024/05/CYB_60704_Advisory_v1.0.pdf"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-36059",
"datePublished": "2024-06-27T00:00:00.000Z",
"dateReserved": "2024-05-19T00:00:00.000Z",
"dateUpdated": "2024-08-02T03:30:13.119Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-90647 (GCVE-0-2026-90647)
Vulnerability from cvelistv5 – Published: 2026-09-12 22:38 – Updated: 2026-09-15 17:10
VLAI
EPSS
VEX
Summary
ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client (Task Mode). This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneous faults, enabling a Man-in-the-Middle attack on protected communications.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 17:09 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ase-systems.com/wp-content/uploads/20… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Kalkitech | ASE2000 V2 Communication Test Set |
Affected:
2.35 , < 2.38
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90647",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T17:09:34.244525Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T17:10:28.897Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "ASE2000 V2 Communication Test Set",
"vendor": "Kalkitech",
"versions": [
{
"lessThan": "2.38",
"status": "affected",
"version": "2.35",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client (Task Mode). This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneous faults, enabling a Man-in-the-Middle attack on protected communications."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-12T22:38:16.637Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ase-systems.com/wp-content/uploads/2026/07/CYB_2026_86278_Advisory_v1.0.pdf"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-90647",
"datePublished": "2026-09-12T22:38:16.637Z",
"dateReserved": "2026-09-12T22:28:32.772Z",
"dateUpdated": "2026-09-15T17:10:28.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-36059 (GCVE-0-2024-36059)
Vulnerability from cvelistv5 – Published: 2024-06-27 00:00 – Updated: 2024-08-02 03:30
VLAI
EPSS
VEX
Summary
Directory Traversal vulnerability in Kalkitech ASE ASE61850 IEDSmart upto and including version 2.3.5 allows attackers to read/write arbitrary files via the IEC61850 File Transfer protocol.
Severity
9.4 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-09 15:38 UTC
CWE
- n/a
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kalkitech | ase61850_iedsmart |
Affected:
0 , ≤ 2.3.5
(custom)
cpe:2.3:o:kalkitech:ase61850_iedsmart:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:kalkitech:ase61850_iedsmart:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ase61850_iedsmart",
"vendor": "kalkitech",
"versions": [
{
"lessThanOrEqual": "2.3.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-36059",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-09T15:38:38.992124Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-09T15:46:21.623Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:30:13.119Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://kalkitech.com/wp-content/uploads/2024/05/CYB_60704_Advisory_v1.0.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Directory Traversal vulnerability in Kalkitech ASE ASE61850 IEDSmart upto and including version 2.3.5 allows attackers to read/write arbitrary files via the IEC61850 File Transfer protocol."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-27T21:43:42.247Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://kalkitech.com/wp-content/uploads/2024/05/CYB_60704_Advisory_v1.0.pdf"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-36059",
"datePublished": "2024-06-27T00:00:00.000Z",
"dateReserved": "2024-05-19T00:00:00.000Z",
"dateUpdated": "2024-08-02T03:30:13.119Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
VAR-202201-0170
Vulnerability from variot - Updated: 2024-11-23 22:50A security vulnerability originally reported in the SYNC2101 product, and applicable to specific sub-families of SYNC devices, allows an attacker to download the configuration file used in the device and apply a modified configuration file back to the device. The attack requires network access to the SYNC device and knowledge of its IP address. The attack exploits the unsecured communication channel used between the administration tool Easyconnect and the SYNC device (in the affected family of SYNC products). plural SYNC There is an unspecified vulnerability in the device.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Kalkitech Sync Products is a range of substation gateways from the Indian company Kalkitech
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202201-0170",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "sync3000-m3",
"scope": "lte",
"trust": 1.0,
"vendor": "kalkitech",
"version": "4.15.3"
},
{
"model": "sync2000-m2",
"scope": "lte",
"trust": 1.0,
"vendor": "kalkitech",
"version": "4.15.3"
},
{
"model": "sync2111-m2",
"scope": "lte",
"trust": 1.0,
"vendor": "kalkitech",
"version": "4.15.3"
},
{
"model": "sync221-m1",
"scope": "lte",
"trust": 1.0,
"vendor": "kalkitech",
"version": "4.15.3"
},
{
"model": "sync241-m2",
"scope": "lte",
"trust": 1.0,
"vendor": "kalkitech",
"version": "4.15.3"
},
{
"model": "sync241-m4",
"scope": "lte",
"trust": 1.0,
"vendor": "kalkitech",
"version": "4.15.3"
},
{
"model": "sync2000-m1",
"scope": "lte",
"trust": 1.0,
"vendor": "kalkitech",
"version": "4.15.3"
},
{
"model": "sync2101-m8",
"scope": "lte",
"trust": 1.0,
"vendor": "kalkitech",
"version": "4.15.3"
},
{
"model": "sync3000-m2",
"scope": "lte",
"trust": 1.0,
"vendor": "kalkitech",
"version": "4.15.3"
},
{
"model": "sync3000-m4",
"scope": "lte",
"trust": 1.0,
"vendor": "kalkitech",
"version": "4.15.3"
},
{
"model": "sync261-m1",
"scope": "lte",
"trust": 1.0,
"vendor": "kalkitech",
"version": "4.15.3"
},
{
"model": "sync2101-m7",
"scope": "lte",
"trust": 1.0,
"vendor": "kalkitech",
"version": "4.15.3"
},
{
"model": "sync2101-m2",
"scope": "lte",
"trust": 1.0,
"vendor": "kalkitech",
"version": "4.15.3"
},
{
"model": "sync2000-m4",
"scope": "lte",
"trust": 1.0,
"vendor": "kalkitech",
"version": "4.15.3"
},
{
"model": "sync3000-m1",
"scope": "lte",
"trust": 1.0,
"vendor": "kalkitech",
"version": "4.15.3"
},
{
"model": "sync2101-m1",
"scope": "lte",
"trust": 1.0,
"vendor": "kalkitech",
"version": "4.15.3"
},
{
"model": "sync3000-m12",
"scope": "lte",
"trust": 1.0,
"vendor": "kalkitech",
"version": "4.15.3"
},
{
"model": "sync2111-m3",
"scope": "lte",
"trust": 1.0,
"vendor": "kalkitech",
"version": "4.15.3"
},
{
"model": "sync2101-m6",
"scope": "lte",
"trust": 1.0,
"vendor": "kalkitech",
"version": "4.15.3"
},
{
"model": "sync241-m1",
"scope": "lte",
"trust": 1.0,
"vendor": "kalkitech",
"version": "4.15.3"
},
{
"model": "sync241-m1",
"scope": null,
"trust": 0.8,
"vendor": "kalki communication pvt",
"version": null
},
{
"model": "sync2000-m4",
"scope": null,
"trust": 0.8,
"vendor": "kalki communication pvt",
"version": null
},
{
"model": "sync2000-m1",
"scope": null,
"trust": 0.8,
"vendor": "kalki communication pvt",
"version": null
},
{
"model": "sync241-m4",
"scope": null,
"trust": 0.8,
"vendor": "kalki communication pvt",
"version": null
},
{
"model": "sync2101-m1",
"scope": null,
"trust": 0.8,
"vendor": "kalki communication pvt",
"version": null
},
{
"model": "sync2101-m6",
"scope": null,
"trust": 0.8,
"vendor": "kalki communication pvt",
"version": null
},
{
"model": "sync241-m2",
"scope": null,
"trust": 0.8,
"vendor": "kalki communication pvt",
"version": null
},
{
"model": "sync2000-m2",
"scope": null,
"trust": 0.8,
"vendor": "kalki communication pvt",
"version": null
},
{
"model": "sync2101-m2",
"scope": null,
"trust": 0.8,
"vendor": "kalki communication pvt",
"version": null
},
{
"model": "sync261-m1",
"scope": null,
"trust": 0.8,
"vendor": "kalki communication pvt",
"version": null
},
{
"model": "sync products",
"scope": null,
"trust": 0.6,
"vendor": "kalkitech",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-09797"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-017713"
},
{
"db": "NVD",
"id": "CVE-2021-44564"
}
]
},
"cve": "CVE-2021-44564",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2021-44564",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2022-09797",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.2,
"id": "CVE-2021-44564",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "High",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.1,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2021-44564",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2021-44564",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2021-44564",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2022-09797",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202201-425",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-09797"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-017713"
},
{
"db": "CNNVD",
"id": "CNNVD-202201-425"
},
{
"db": "NVD",
"id": "CVE-2021-44564"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A security vulnerability originally reported in the SYNC2101 product, and applicable to specific sub-families of SYNC devices, allows an attacker to download the configuration file used in the device and apply a modified configuration file back to the device. The attack requires network access to the SYNC device and knowledge of its IP address. The attack exploits the unsecured communication channel used between the administration tool Easyconnect and the SYNC device (in the affected family of SYNC products). plural SYNC There is an unspecified vulnerability in the device.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Kalkitech Sync Products is a range of substation gateways from the Indian company Kalkitech",
"sources": [
{
"db": "NVD",
"id": "CVE-2021-44564"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-017713"
},
{
"db": "CNVD",
"id": "CNVD-2022-09797"
},
{
"db": "VULMON",
"id": "CVE-2021-44564"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2021-44564",
"trust": 3.9
},
{
"db": "JVNDB",
"id": "JVNDB-2021-017713",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2022-09797",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202201-425",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2021-44564",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-09797"
},
{
"db": "VULMON",
"id": "CVE-2021-44564"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-017713"
},
{
"db": "CNNVD",
"id": "CNNVD-202201-425"
},
{
"db": "NVD",
"id": "CVE-2021-44564"
}
]
},
"id": "VAR-202201-0170",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-09797"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-09797"
}
]
},
"last_update_date": "2024-11-23T22:50:58.181000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "CYB/2021/33631 Kalkitech",
"trust": 0.8,
"url": "https://kalkitech.com/wp-content/uploads/2022/01/CYB_33631_Advisory.pdf"
},
{
"title": "Patch for Kalkitech Sync Products Encryption Issue Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/318996"
},
{
"title": "Kalkitech Sync Products Fixes for encryption problem vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=178023"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-09797"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-017713"
},
{
"db": "CNNVD",
"id": "CNNVD-202201-425"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "Lack of information (CWE-noinfo) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-017713"
},
{
"db": "NVD",
"id": "CVE-2021-44564"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.3,
"url": "https://kalkitech.com/wp-content/uploads/cyb_33631_advisory.pdf"
},
{
"trust": 1.7,
"url": "https://www.kalkitech.com/cybersecurity/"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-44564"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-09797"
},
{
"db": "VULMON",
"id": "CVE-2021-44564"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-017713"
},
{
"db": "CNNVD",
"id": "CNNVD-202201-425"
},
{
"db": "NVD",
"id": "CVE-2021-44564"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2022-09797"
},
{
"db": "VULMON",
"id": "CVE-2021-44564"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-017713"
},
{
"db": "CNNVD",
"id": "CNNVD-202201-425"
},
{
"db": "NVD",
"id": "CVE-2021-44564"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-02-12T00:00:00",
"db": "CNVD",
"id": "CNVD-2022-09797"
},
{
"date": "2022-01-06T00:00:00",
"db": "VULMON",
"id": "CVE-2021-44564"
},
{
"date": "2023-02-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2021-017713"
},
{
"date": "2022-01-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202201-425"
},
{
"date": "2022-01-06T12:15:08.190000",
"db": "NVD",
"id": "CVE-2021-44564"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-02-12T00:00:00",
"db": "CNVD",
"id": "CNVD-2022-09797"
},
{
"date": "2022-01-06T00:00:00",
"db": "VULMON",
"id": "CVE-2021-44564"
},
{
"date": "2023-02-01T07:27:00",
"db": "JVNDB",
"id": "JVNDB-2021-017713"
},
{
"date": "2022-01-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202201-425"
},
{
"date": "2024-11-21T06:31:13.317000",
"db": "NVD",
"id": "CVE-2021-44564"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202201-425"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural \u00a0SYNC\u00a0 Vulnerabilities in devices",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-017713"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "encryption problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202201-425"
}
],
"trust": 0.6
}
}
VAR-201905-1150
Vulnerability from variot - Updated: 2024-11-23 22:12Kalki Kalkitech SYNC3000 Substation DCU GPC v2.22.6, 2.23.0, 2.24.0, 3.0.0, 3.1.0, 3.1.16, 3.2.3, 3.2.6, 3.5.0, 3.6.0, and 3.6.1, when WebHMI is not installed, allows an attacker to inject client-side commands or scripts to be executed on the device with privileged access, aka CYB/2019/19561. The attack requires network connectivity to the device and exploits the webserver interface, typically through a browser. Kalki Kalkitech SYNC3000 Substation DCU Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Kalkitech SYNC3000 Substation DCU GPC is a substation data concentrator and communication device. A security vulnerability exists in the Kalkitech SYNC3000 Substation DCU GPC. An attacker could exploit this vulnerability to execute injected client commands or scripts. The following products and versions are affected: Kalkitech SYNC3000 Substation DCU GPC Version 2.22.6, Version 2.23.0, Version 2.24.0, Version 3.0.0, Version 3.1.0, Version 3.1.16, Version 3.2.3, Version 3.2.6 Version, version 3.5.0, version 3.6.0, version 3.6.1
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201905-1150",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "sync3000",
"scope": "eq",
"trust": 1.0,
"vendor": "kalkitech",
"version": "3.2.3"
},
{
"model": "sync3000",
"scope": "eq",
"trust": 1.0,
"vendor": "kalkitech",
"version": "2.23.0"
},
{
"model": "sync3000",
"scope": "eq",
"trust": 1.0,
"vendor": "kalkitech",
"version": "3.5.0"
},
{
"model": "sync3000",
"scope": "eq",
"trust": 1.0,
"vendor": "kalkitech",
"version": "3.6.0"
},
{
"model": "sync3000",
"scope": "eq",
"trust": 1.0,
"vendor": "kalkitech",
"version": "2.22.6"
},
{
"model": "sync3000",
"scope": "eq",
"trust": 1.0,
"vendor": "kalkitech",
"version": "3.1.16"
},
{
"model": "sync3000",
"scope": "eq",
"trust": 1.0,
"vendor": "kalkitech",
"version": "3.6.1"
},
{
"model": "sync3000",
"scope": "eq",
"trust": 1.0,
"vendor": "kalkitech",
"version": "2.24.0"
},
{
"model": "sync3000",
"scope": "eq",
"trust": 1.0,
"vendor": "kalkitech",
"version": "3.0.0"
},
{
"model": "sync3000",
"scope": "eq",
"trust": 1.0,
"vendor": "kalkitech",
"version": "3.2.6"
},
{
"model": "sync3000",
"scope": "eq",
"trust": 1.0,
"vendor": "kalkitech",
"version": "3.1.0"
},
{
"model": "sync 3000",
"scope": "eq",
"trust": 0.8,
"vendor": "kalki communication pvt",
"version": "gpc 2.22.6"
},
{
"model": "sync 3000",
"scope": "eq",
"trust": 0.8,
"vendor": "kalki communication pvt",
"version": "gpc 2.23.0"
},
{
"model": "sync 3000",
"scope": "eq",
"trust": 0.8,
"vendor": "kalki communication pvt",
"version": "gpc 2.24.0"
},
{
"model": "sync 3000",
"scope": "eq",
"trust": 0.8,
"vendor": "kalki communication pvt",
"version": "gpc 3.0.0"
},
{
"model": "sync 3000",
"scope": "eq",
"trust": 0.8,
"vendor": "kalki communication pvt",
"version": "gpc 3.1.0"
},
{
"model": "sync 3000",
"scope": "eq",
"trust": 0.8,
"vendor": "kalki communication pvt",
"version": "gpc 3.1.16"
},
{
"model": "sync 3000",
"scope": "eq",
"trust": 0.8,
"vendor": "kalki communication pvt",
"version": "gpc 3.2.3"
},
{
"model": "sync 3000",
"scope": "eq",
"trust": 0.8,
"vendor": "kalki communication pvt",
"version": "gpc 3.2.6"
},
{
"model": "sync 3000",
"scope": "eq",
"trust": 0.8,
"vendor": "kalki communication pvt",
"version": "gpc 3.5.0"
},
{
"model": "sync 3000",
"scope": "eq",
"trust": 0.8,
"vendor": "kalki communication pvt",
"version": "gpc 3.6.0"
},
{
"model": "sync 3000",
"scope": "eq",
"trust": 0.8,
"vendor": "kalki communication pvt",
"version": "gpc 3.6.1"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-004822"
},
{
"db": "NVD",
"id": "CVE-2019-11536"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:kalkitech:sync3000_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-004822"
}
]
},
"cve": "CVE-2019-11536",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2019-11536",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-143192",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2019-11536",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2019-11536",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2019-11536",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNNVD",
"id": "CNNVD-201905-889",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-143192",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2019-11536",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-143192"
},
{
"db": "VULMON",
"id": "CVE-2019-11536"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004822"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-889"
},
{
"db": "NVD",
"id": "CVE-2019-11536"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Kalki Kalkitech SYNC3000 Substation DCU GPC v2.22.6, 2.23.0, 2.24.0, 3.0.0, 3.1.0, 3.1.16, 3.2.3, 3.2.6, 3.5.0, 3.6.0, and 3.6.1, when WebHMI is not installed, allows an attacker to inject client-side commands or scripts to be executed on the device with privileged access, aka CYB/2019/19561. The attack requires network connectivity to the device and exploits the webserver interface, typically through a browser. Kalki Kalkitech SYNC3000 Substation DCU Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Kalkitech SYNC3000 Substation DCU GPC is a substation data concentrator and communication device. A security vulnerability exists in the Kalkitech SYNC3000 Substation DCU GPC. An attacker could exploit this vulnerability to execute injected client commands or scripts. The following products and versions are affected: Kalkitech SYNC3000 Substation DCU GPC Version 2.22.6, Version 2.23.0, Version 2.24.0, Version 3.0.0, Version 3.1.0, Version 3.1.16, Version 3.2.3, Version 3.2.6 Version, version 3.5.0, version 3.6.0, version 3.6.1",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-11536"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004822"
},
{
"db": "VULHUB",
"id": "VHN-143192"
},
{
"db": "VULMON",
"id": "CVE-2019-11536"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-11536",
"trust": 2.6
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004822",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201905-889",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-143192",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2019-11536",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-143192"
},
{
"db": "VULMON",
"id": "CVE-2019-11536"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004822"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-889"
},
{
"db": "NVD",
"id": "CVE-2019-11536"
}
]
},
"id": "VAR-201905-1150",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-143192"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T22:12:00.909000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "CYB/2019/19561",
"trust": 0.8,
"url": "https://www.kalkitech.com/wp-content/uploads/CYB_19561_Advisory.pdf"
},
{
"title": "Cybersecurity",
"trust": 0.8,
"url": "https://www.kalkitech.com/cybersecurity/"
},
{
"title": "Kalki Kalkitech SYNC3000 Substation DCU GPC Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=92868"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-004822"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-889"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-264",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-143192"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004822"
},
{
"db": "NVD",
"id": "CVE-2019-11536"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.8,
"url": "https://www.kalkitech.com/cybersecurity/"
},
{
"trust": 1.8,
"url": "https://www.kalkitech.com/wp-content/uploads/cyb_19561_advisory.pdf"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-11536"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-11536"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-143192"
},
{
"db": "VULMON",
"id": "CVE-2019-11536"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004822"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-889"
},
{
"db": "NVD",
"id": "CVE-2019-11536"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-143192"
},
{
"db": "VULMON",
"id": "CVE-2019-11536"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004822"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-889"
},
{
"db": "NVD",
"id": "CVE-2019-11536"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-05-22T00:00:00",
"db": "VULHUB",
"id": "VHN-143192"
},
{
"date": "2019-05-22T00:00:00",
"db": "VULMON",
"id": "CVE-2019-11536"
},
{
"date": "2019-06-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-004822"
},
{
"date": "2019-05-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201905-889"
},
{
"date": "2019-05-22T18:29:00.537000",
"db": "NVD",
"id": "CVE-2019-11536"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-08-24T00:00:00",
"db": "VULHUB",
"id": "VHN-143192"
},
{
"date": "2020-08-24T00:00:00",
"db": "VULMON",
"id": "CVE-2019-11536"
},
{
"date": "2019-06-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-004822"
},
{
"date": "2020-08-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201905-889"
},
{
"date": "2024-11-21T04:21:17.520000",
"db": "NVD",
"id": "CVE-2019-11536"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201905-889"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Kalki Kalkitech SYNC3000 Substation DCU Vulnerabilities related to authorization, permissions, and access control",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-004822"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control issues",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201905-889"
}
],
"trust": 0.6
}
}