Lucene search

[email protected]NVD:CVE-2021-27428

HistoryMar 23, 2022 - 8:15 p.m.

CVE-2021-27428

2022-03-2320:15:08

CWE-434

[email protected]

web.nvd.nist.gov

ge ur ied

firmware upgrading

enervista ur setup

authenticity validation

integrity validation

illegitimate user

firmware version

privileges

firmware weakness

firmware mitigation

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

59.5%

JSON

GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without appropriate privileges. The weakness is assessed, and mitigation is implemented in firmware Version 8.10.

Affected configurations

Nvd

Node

gemultilin_b30_firmwareRange<8.10

AND

gemultilin_b30Match-

Node

gemultilin_b90_firmwareRange<8.10

AND

gemultilin_b90Match-

Node

gemultilin_c60_firmwareRange<8.10

AND

gemultilin_c60Match-

Node

gemultilin_c70_firmwareRange<8.10

AND

gemultilin_c70Match-

Node

gemultilin_c95_firmwareRange<8.10

AND

gemultilin_c95Match-

Node

gemultilin_d30_firmwareRange<8.10

AND

gemultilin_d30Match-

Node

gemultilin_d60_firmwareRange<8.10

AND

gemultilin_d60Match-

Node

gemultilin_f35_firmwareRange<8.10

AND

gemultilin_f35Match-

Node

gemultilin_f60_firmwareRange<8.10

AND

gemultilin_f60Match-

Node

gemultilin_g30_firmwareRange<8.10

AND

gemultilin_g30Match-

Node

gemultilin_g60_firmwareRange<8.10

AND

gemultilin_g60Match-

Node

gemultilin_l30_firmwareRange<8.10

AND

gemultilin_l30Match-

Node

gemultilin_l60_firmwareRange<8.10

AND

gemultilin_l60Match-

Node

gemultilin_l90_firmwareRange<8.10

AND

gemultilin_l90Match-

Node

gemultilin_m60_firmwareRange<8.10

AND

gemultilin_m60Match-

Node

gemultilin_n60_firmwareRange<8.10

AND

gemultilin_n60Match-

Node

gemultilin_t35_firmwareRange<8.10

AND

gemultilin_t35Match-

Node

gemultilin_t60_firmwareRange<8.10

AND

gemultilin_t60Match-

Node

gemultilin_c30_firmwareRange<8.10

AND

gemultilin_c30Match-

VendorProductVersionCPE
gemultilin_b30_firmware*cpe:2.3:o:ge:multilin_b30_firmware:*:*:*:*:*:*:*:*
gemultilin_b30-cpe:2.3:h:ge:multilin_b30:-:*:*:*:*:*:*:*
gemultilin_b90_firmware*cpe:2.3:o:ge:multilin_b90_firmware:*:*:*:*:*:*:*:*
gemultilin_b90-cpe:2.3:h:ge:multilin_b90:-:*:*:*:*:*:*:*
gemultilin_c60_firmware*cpe:2.3:o:ge:multilin_c60_firmware:*:*:*:*:*:*:*:*
gemultilin_c60-cpe:2.3:h:ge:multilin_c60:-:*:*:*:*:*:*:*
gemultilin_c70_firmware*cpe:2.3:o:ge:multilin_c70_firmware:*:*:*:*:*:*:*:*
gemultilin_c70-cpe:2.3:h:ge:multilin_c70:-:*:*:*:*:*:*:*
gemultilin_c95_firmware*cpe:2.3:o:ge:multilin_c95_firmware:*:*:*:*:*:*:*:*
gemultilin_c95-cpe:2.3:h:ge:multilin_c95:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ge	multilin_b30_firmware	*	cpe:2.3:o:ge:multilin_b30_firmware::::::::
ge	multilin_b30	-	cpe:2.3:h:ge:multilin_b30:-:::::::*
ge	multilin_b90_firmware	*	cpe:2.3:o:ge:multilin_b90_firmware::::::::
ge	multilin_b90	-	cpe:2.3:h:ge:multilin_b90:-:::::::*
ge	multilin_c60_firmware	*	cpe:2.3:o:ge:multilin_c60_firmware::::::::
ge	multilin_c60	-	cpe:2.3:h:ge:multilin_c60:-:::::::*
ge	multilin_c70_firmware	*	cpe:2.3:o:ge:multilin_c70_firmware::::::::
ge	multilin_c70	-	cpe:2.3:h:ge:multilin_c70:-:::::::*
ge	multilin_c95_firmware	*	cpe:2.3:o:ge:multilin_c95_firmware::::::::
ge	multilin_c95	-	cpe:2.3:h:ge:multilin_c95:-:::::::*

Rows per page:

1-10 of 381

References

www.cisa.gov/uscert/ics/advisories/icsa-21-075-02

www.gegridsolutions.com/Passport/Login.aspx

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

59.5%

JSON

Related for NVD:CVE-2021-27428

cvelist1 prion1 cve1 threatpost1 thn1 ics1