CVE-2021-27426

Summary

GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a “Factory” user.

Affected Software

Weaknesses

• CWE-453: CWE-453 Insecure Default Variable Initialization

Workarounds

GE recommends protecting UR IED by using network defense-in-depth practices. This includes, but is not limited to, placing UR IED inside the control system network security perimeter, and having access controls, monitoring (such as an Intrusion Detection System), and other mitigating technologies in place.

GE recommends users refer to the UR Deployment guide for secure configuration of UR IED and system.

ADP Enrichment

CVE Program Container

Additional References

• https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02
• https://www.gegridsolutions.com/Passport/Login.aspx

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: total

References

• https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02
• https://www.gegridsolutions.com/Passport/Login.aspx

• ←Previous
• Next→