Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Severity
High
Analysis Summary
The vulnerability exists due to improper neutralization of input during web page generation process. The web application browser interprets input as active HTML, JavaScript, or VBScript, which could allow an attacker to execute arbitrary code.
Affected Vendors
PSI GridConnect GmbH
Affected Products
Telecontrol Gateway and Smart Telecontrol Unit family
IEC104 Security Proxy
Telecontrol Gateway 3G Versions 4.2.21
5.0.27
5.1.19
6.0.16 and prior;
Telecontrol Gateway XS-MU Versions 4.2.21
Telecontrol Gateway VM Versions 4.2.21
Smart Telecontrol Unit TCG Versions 5.0.27
6.0.16 and prior; and
IEC104 Security Proxy Version 2.2.10 and prior.
Remediation
A fix for the vulnerability is available in the following software releases:
The following software releases are no longer supported:
PSI recommends deactivating the webserver via CLI since the web interface is not essential to the configuration of the device.