CVE-2021-27422

Summary

GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol. It allows sensitive information exposure without authentication.

Affected Software

Weaknesses

• CWE-200: CWE-200 Information Exposure

Workarounds

GE recommends protecting UR IED by using network defense-in-depth practices. This includes, but is not limited to, placing UR IED inside the control system network security perimeter, and having access controls, monitoring (such as an Intrusion Detection System), and other mitigating technologies in place.

GE recommends users refer to the UR Deployment guide for secure configuration of UR IED and system.

ADP Enrichment

CVE Program Container

Additional References

• https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02
• https://www.gegridsolutions.com/Passport/Login.aspx

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02
• https://www.gegridsolutions.com/Passport/Login.aspx

• ←Previous
• Next→