Lucene search

[email protected]CVE-2021-27428

HistoryMar 23, 2022 - 8:15 p.m.

CVE-2021-27428

2022-03-2320:15:08

CWE-434

[email protected]

web.nvd.nist.gov

ur ied

firmware

upgrade

unauthorized

vulnerability

cve-2021-27428

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

59.5%

JSON

GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without appropriate privileges. The weakness is assessed, and mitigation is implemented in firmware Version 8.10.

Affected configurations

NVD

Node

gemultilin_b30_firmwareRange<8.10

AND

gemultilin_b30Match-

Node

gemultilin_b90_firmwareRange<8.10

AND

gemultilin_b90Match-

Node

gemultilin_c60_firmwareRange<8.10

AND

gemultilin_c60Match-

Node

gemultilin_c70_firmwareRange<8.10

AND

gemultilin_c70Match-

Node

gemultilin_c95_firmwareRange<8.10

AND

gemultilin_c95Match-

Node

gemultilin_d30_firmwareRange<8.10

AND

gemultilin_d30Match-

Node

gemultilin_d60_firmwareRange<8.10

AND

gemultilin_d60Match-

Node

gemultilin_f35_firmwareRange<8.10

AND

gemultilin_f35Match-

Node

gemultilin_f60_firmwareRange<8.10

AND

gemultilin_f60Match-

Node

gemultilin_g30_firmwareRange<8.10

AND

gemultilin_g30Match-

Node

gemultilin_g60_firmwareRange<8.10

AND

gemultilin_g60Match-

Node

gemultilin_l30_firmwareRange<8.10

AND

gemultilin_l30Match-

Node

gemultilin_l60_firmwareRange<8.10

AND

gemultilin_l60Match-

Node

gemultilin_l90_firmwareRange<8.10

AND

gemultilin_l90Match-

Node

gemultilin_m60_firmwareRange<8.10

AND

gemultilin_m60Match-

Node

gemultilin_n60_firmwareRange<8.10

AND

gemultilin_n60Match-

Node

gemultilin_t35_firmwareRange<8.10

AND

gemultilin_t35Match-

Node

gemultilin_t60_firmwareRange<8.10

AND

gemultilin_t60Match-

Node

gemultilin_c30_firmwareRange<8.10

AND

gemultilin_c30Match-

CPENameOperatorVersion
ge:multilin_b30_firmwarege multilin b30 firmwarelt8.10

CPE	Name	Operator	Version
ge:multilin_b30_firmware	ge multilin b30 firmware	lt	8.10

CNA Affected

[
  {
    "product": "UR family",
    "vendor": "GE",
    "versions": [
      {
        "lessThan": "8.1x",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/uscert/ics/advisories/icsa-21-075-02

www.gegridsolutions.com/Passport/Login.aspx

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

59.5%

JSON

Related for CVE-2021-27428

cvelist1 prion1 nvd1 threatpost1 thn1 ics1