CVE-2021-27428

CRITICAL

9.8

Descricao

GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without appropriate privileges. The weakness is assessed, and mitigation is implemented in firmware Version 8.10.

Detalhes CVE

Pontuacao CVSS v3.19.8

SeveridadeCRITICAL

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado3/23/2022

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

ge:multilin_b30ge:multilin_b30_firmwarege:multilin_b90ge:multilin_b90_firmwarege:multilin_c30ge:multilin_c30_firmwarege:multilin_c60ge:multilin_c60_firmwarege:multilin_c70ge:multilin_c70_firmwarege:multilin_c95ge:multilin_c95_firmwarege:multilin_d30ge:multilin_d30_firmwarege:multilin_d60ge:multilin_d60_firmwarege:multilin_f35ge:multilin_f35_firmwarege:multilin_f60ge:multilin_f60_firmwarege:multilin_g30ge:multilin_g30_firmwarege:multilin_g60ge:multilin_g60_firmwarege:multilin_l30ge:multilin_l30_firmwarege:multilin_l60ge:multilin_l60_firmwarege:multilin_l90ge:multilin_l90_firmwarege:multilin_m60ge:multilin_m60_firmwarege:multilin_n60ge:multilin_n60_firmwarege:multilin_t35ge:multilin_t35_firmwarege:multilin_t60ge:multilin_t60_firmware

Fraquezas (CWE)

CWE-434CWE-434

Referencias

https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02(ics-cert@hq.dhs.gov)

https://www.gegridsolutions.com/Passport/Login.aspx(ics-cert@hq.dhs.gov)

https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02(af854a3a-2127-422b-91ae-364da2661108)

https://www.gegridsolutions.com/Passport/Login.aspx(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.