Vulnerabilities > CVE-2021-27424 - Exposure of Resource to Wrong Sphere vulnerability in GE products

CVSS 5.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

NONE

Availability impact

NONE

network

low complexity

CWE-668

NVD

Published: 2022-03-23

Updated: 2022-04-01

Summary

GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. GE was made aware a “Last-key pressed” MODBUS register can be used to gain unauthorized information.

Vulnerable Configurations

Part	Description	Count
OS	Ge GE Multilin B30 Firmware - GE Multilin B90 Firmware - GE Multilin C60 Firmware - GE Multilin C70 Firmware - GE Multilin C95 Firmware - GE Multilin D30 Firmware - GE Multilin D60 Firmware - GE Multilin F35 Firmware - GE Multilin F60 Firmware - GE Multilin G30 Firmware - GE Multilin G60 Firmware - GE Multilin L30 Firmware - GE Multilin L60 Firmware - GE Multilin L90 Firmware - GE Multilin M60 Firmware - GE Multilin N60 Firmware - GE Multilin T35 Firmware - GE Multilin T60 Firmware - GE Multilin C30 Firmware -	19
Hardware	Ge GE Multilin B30 - GE Multilin B90 - GE Multilin C60 - GE Multilin C70 - GE Multilin C95 - GE Multilin D30 - GE Multilin D60 - GE Multilin F35 - GE Multilin F60 - GE Multilin G30 - GE Multilin G60 - GE Multilin L30 - GE Multilin L60 - GE Multilin L90 - GE Multilin M60 - GE Multilin N60 - GE Multilin T35 - GE Multilin T60 - GE Multilin C30 -	19

Common Weakness Enumeration (CWE)

CWE-668 - Exposure of Resource to Wrong Sphere

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References