CVE-2020-25197

Summary

A code injection vulnerability exists in one of the webpages in GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06 that could allow an authenticated remote attacker to execute arbitrary code on the system.

Affected Software

VendorProductVersion RangeStatus
GEReason RT43X Clocksunspecified < 08A06affected

Weaknesses

  • CWE-94: CWE-94 Improper Control of Generation of Code ('Code Injection')

Workarounds

GE recommends users evaluate current risk and implement appropriate network security mitigation measures as follows. The following mitigation actions do not ensure complete security but should be considered until the affected time synchronization product is upgraded: Use strong network and physical security protection to prevent an attacker from reaching the local network where Reason RT43X clocks are normally installed. Block TCP/IP Ports 80 and 443 to block the HTTP/HTTPS access to web interface with Reason RT43X products, avoiding all the vulnerabilities. This TCP/IP port blocking should be limited to the Ethernet port interface where the Reason RT43X clock is connected (e.g., using Access Control List (ACL)). Otherwise, other HTTP/HTTPS applications may be affected. Minimize network exposure for all control system devices and/or systems and ensure they are not accessible from the Internet. Analyze security events to early detect unexpected traffic/communication.

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: total

References