Lucene search

IcscertCVE-2020-25197

HistoryMar 18, 2022 - 6:15 p.m.

CVE-2020-25197

2022-03-1818:15:09

CWE-94

icscert

web.nvd.nist.gov

cve-2020-25197

code injection

ge reason

rt430

rt431

rt434

gnss clocks

firmware

vulnerability

remote attacker

arbitrary code

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.003

Percentile

68.4%

JSON

A code injection vulnerability exists in one of the webpages in GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06 that could allow an authenticated remote attacker to execute arbitrary code on the system.

Affected configurations

Nvd

Node

gert430Match-

AND

gert430_firmwareRange<08a06

Node

gert431Match-

AND

gert431_firmwareRange<08a06

Node

gert434Match-

AND

gert434_firmwareRange<08a06

VendorProductVersionCPE
gert430-cpe:2.3:h:ge:rt430:-:*:*:*:*:*:*:*
gert430_firmware*cpe:2.3:o:ge:rt430_firmware:*:*:*:*:*:*:*:*
gert431-cpe:2.3:h:ge:rt431:-:*:*:*:*:*:*:*
gert431_firmware*cpe:2.3:o:ge:rt431_firmware:*:*:*:*:*:*:*:*
gert434-cpe:2.3:h:ge:rt434:-:*:*:*:*:*:*:*
gert434_firmware*cpe:2.3:o:ge:rt434_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ge	rt430	-	cpe:2.3:h:ge:rt430:-:::::::*
ge	rt430_firmware	*	cpe:2.3:o:ge:rt430_firmware::::::::
ge	rt431	-	cpe:2.3:h:ge:rt431:-:::::::*
ge	rt431_firmware	*	cpe:2.3:o:ge:rt431_firmware::::::::
ge	rt434	-	cpe:2.3:h:ge:rt434:-:::::::*
ge	rt434_firmware	*	cpe:2.3:o:ge:rt434_firmware::::::::

CNA Affected

[
  {
    "product": "Reason RT43X Clocks",
    "vendor": "GE",
    "versions": [
      {
        "lessThan": "08A06",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/uscert/ics/advisories/icsa-21-005-03

www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430&type=21&file=5

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.003

Percentile

68.4%

JSON

Related for CVE-2020-25197