CVE-2021-27426

GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a “Factory” user...

CVE-2021-27428

GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without...

CVE-2025-27253

A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to...

CVE-2025-27253: External Control of System or Configuration Setting

A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to...

PT-2025-10568

Name of the Vulnerable Software and Affected Versions GE Vernova UR IED family devices affected versions not specified Description The issue concerns an Insufficient Verification of Data Authenticity, which enables an authenticated user to install modified firmware. This is possible because...

CVE-2025-27257: Insufficient Verification of Data Authenticity

Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware. The firmware signature verification is enforced only on the client-side dedicated software Enervista UR Setup, allowing the integration che...

PT-2025-10564

Name of the Vulnerable Software and Affected Versions GE Vernova UR IED family devices versions 7.0 through 8.60 Description The issue is related to improper input validation, which allows an attacker to establish a TCP connection through port forwarding. This lack of validation for IP addresses...

CVE-2021-27426

GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a “Factory” user...

CVE-2021-27428

GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without...

Code injection

GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a “Factory” user...

CVE-2021-27426 GE UR family insecure default variable initialization

GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a “Factory” user...

CVE-2021-27426

CVE-2021-27426 affects GE UR family UR IEDs; prior to firmware 8.1x with Basic security, the device does not allow disabling Factory Mode, enabling servicing by factory users. Root cause is an insecure default variable initialization (CWE-453). Impact per sources includes potential bypass of acce...

CVE-2021-27428

CVE-2021-27428 affects GE UR family UR IED firmware prior to 8.1x, where the UR Setup (Enervista UR Setup) firmware upgrade flow does not enforce appropriate privileges, allowing an illegitimate user to upgrade firmware. The weakness centers on Unrestricted Upload of a Dangerous Type; the vulnera...

PT-2022-9816

Name of the Vulnerable Software and Affected Versions GE UR IED firmware versions prior to 8.1x Description The issue concerns the inability to disable the "Factory Mode" in the firmware, which is used for servicing by a "Factory" user. This mode is accessible with the "Basic" security variant...

CVE-2021-27426: Insecure Default Variable Initialization

GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a “Factory” user...

PT-2022-9817

Name of the Vulnerable Software and Affected Versions GE UR IED firmware versions prior to 8.10 Description The issue allows an illegitimate user to upgrade firmware without appropriate privileges. The UR Setup tool is used for upgrading firmware and validates the authenticity and integrity of th...

CVE-2021-27428: Unrestricted Upload of File with Dangerous Type

GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without...