CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 10.0
CWE Name:  Permissions Privileges and Access Controls
Summary: kalki kalkitech sync3000 substation dcu gpc v2.22.6, 2.23.0, 2.24.0, 3.0.0, 3.1.0, 3.1.16, 3.2.3, 3.2.6, 3.5.0, 3.6.0, and 3.6.1, when webhmi is not installed, allows an attacker to inject client-side commands or scripts to be executed on the device with privileged access, aka cyb/2019/19561. the attack requires network connectivity to the device and exploits the webserver interface, typically through a browser.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2019-05-22
Last Modified Date: 2019-05-24