Medium severity · published Mar 23, 2022
CVE-2021-27418
GE UR firmware versions prior to version 8.1x supports web interface with read-only access
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting attacks, which may be used to send a malicious script. Also, UR Firmware web server does not perform HTML encoding of user-supplied strings.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MB
Multilin B30 Firmware · GE
before 8.10 · source: NVD
MB
Multilin B90 Firmware · GE
before 8.10 · source: NVD
MC
Multilin C30 Firmware · GE
before 8.10 · source: NVD
MC
Multilin C60 Firmware · GE
before 8.10 · source: NVD
MC
Multilin C70 Firmware · GE
before 8.10 · source: NVD
MC
Multilin C95 Firmware · GE
before 8.10 · source: NVD
MD
Multilin D30 Firmware · GE
before 8.10 · source: NVD
MD
Multilin D60 Firmware · GE
before 8.10 · source: NVD
MF
Multilin F35 Firmware · GE
before 8.10 · source: NVD
MF
Multilin F60 Firmware · GE
before 8.10 · source: NVD
MG
Multilin G30 Firmware · GE
before 8.10 · source: NVD
MG
Multilin G60 Firmware · GE
before 8.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27418
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27418
Mitigation
https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02
Permissions Required
https://www.gegridsolutions.com/Passport/Login.aspx
More from Multilin B30 Firmware
9.8
CVE-2021-27428
GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup
9.8
CVE-2021-27426
GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a…
7.5
CVE-2021-27422
GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol
5.3
CVE-2021-27424
GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide
5.3
CVE-2021-27420
GE UR firmware versions prior to version 8.1x web server task does not properly handle receipt of unsupported HTTP verbs, resulting in the web server becoming temporarily…