CVE-2021-27428

CRITICAL

9.8

Beschreibung

GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without appropriate privileges. The weakness is assessed, and mitigation is implemented in firmware Version 8.10.

CVE Details

CVSS v3.1 Bewertung9.8

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht3/23/2022

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

ge:multilin_b30ge:multilin_b30_firmwarege:multilin_b90ge:multilin_b90_firmwarege:multilin_c30ge:multilin_c30_firmwarege:multilin_c60ge:multilin_c60_firmwarege:multilin_c70ge:multilin_c70_firmwarege:multilin_c95ge:multilin_c95_firmwarege:multilin_d30ge:multilin_d30_firmwarege:multilin_d60ge:multilin_d60_firmwarege:multilin_f35ge:multilin_f35_firmwarege:multilin_f60ge:multilin_f60_firmwarege:multilin_g30ge:multilin_g30_firmwarege:multilin_g60ge:multilin_g60_firmwarege:multilin_l30ge:multilin_l30_firmwarege:multilin_l60ge:multilin_l60_firmwarege:multilin_l90ge:multilin_l90_firmwarege:multilin_m60ge:multilin_m60_firmwarege:multilin_n60ge:multilin_n60_firmwarege:multilin_t35ge:multilin_t35_firmwarege:multilin_t60ge:multilin_t60_firmware

Schwachen (CWE)

CWE-434CWE-434

Referenzen

https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02(ics-cert@hq.dhs.gov)

https://www.gegridsolutions.com/Passport/Login.aspx(ics-cert@hq.dhs.gov)

https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02(af854a3a-2127-422b-91ae-364da2661108)

https://www.gegridsolutions.com/Passport/Login.aspx(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.