CVE-2019-18267

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-12-18 · updated 2026-06-17
Weakness: CWE-79

Description

An issue was found in GE S2020/S2020G Fast Switch 61850, S2020/S2020G Fast Switch 61850 Versions 07A03 and prior. An attacker can inject arbitrary Javascript in a specially crafted HTTP request that may be reflected back in the HTTP response. The device is also vulnerable to a stored cross-site scripting vulnerability that may allow session hijacking, disclosure of sensitive data, cross-site request forgery (CSRF) attacks, and remote code execution.

Affected products

GE S2020 Firmware: through 07a03
GE S2020G Firmware: through 07a03

References

https://www.us-cert.gov/ics/advisories/icsa-19-351-01
https://www.us-cert.gov/ics/advisories/icsa-19-351-01

Get alerted when CVE-2019-18267 or the next vulnerability affects your stack