CVE-2021-27426

CRITICAL

9.8

Description

GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a “Factory” user.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published3/23/2022

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

ge:multilin_b30ge:multilin_b30_firmwarege:multilin_b90ge:multilin_b90_firmwarege:multilin_c30ge:multilin_c30_firmwarege:multilin_c60ge:multilin_c60_firmwarege:multilin_c70ge:multilin_c70_firmwarege:multilin_c95ge:multilin_c95_firmwarege:multilin_d30ge:multilin_d30_firmwarege:multilin_d60ge:multilin_d60_firmwarege:multilin_f35ge:multilin_f35_firmwarege:multilin_f60ge:multilin_f60_firmwarege:multilin_g30ge:multilin_g30_firmwarege:multilin_g60ge:multilin_g60_firmwarege:multilin_l30ge:multilin_l30_firmwarege:multilin_l60ge:multilin_l60_firmwarege:multilin_l90ge:multilin_l90_firmwarege:multilin_m60ge:multilin_m60_firmwarege:multilin_n60ge:multilin_n60_firmwarege:multilin_t35ge:multilin_t35_firmwarege:multilin_t60ge:multilin_t60_firmware

Weaknesses (CWE)

CWE-453

References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02(ics-cert@hq.dhs.gov)

https://www.gegridsolutions.com/Passport/Login.aspx(ics-cert@hq.dhs.gov)

https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02(af854a3a-2127-422b-91ae-364da2661108)

https://www.gegridsolutions.com/Passport/Login.aspx(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.