Medium severity · published Mar 23, 2022
CVE-2021-27420
GE UR firmware versions prior to version 8.1x web server task does not properly handle receipt of unsupported HTTP verbs, resulting in the web server becoming temporarily…
5.3
CVSS
1.1%
EPSS
No
On KEV
Description
GE UR firmware versions prior to version 8.1x web server task does not properly handle receipt of unsupported HTTP verbs, resulting in the web server becoming temporarily unresponsive after receiving a series of unsupported HTTP requests. When unresponsive, the web server is inaccessible. By itself, this is not particularly significant as the relay remains effective in all other functionality and communication channels.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MB
Multilin B30 Firmware · GE
before 8.10 · source: NVD
MB
Multilin B90 Firmware · GE
before 8.10 · source: NVD
MC
Multilin C30 Firmware · GE
before 8.10 · source: NVD
MC
Multilin C60 Firmware · GE
before 8.10 · source: NVD
MC
Multilin C70 Firmware · GE
before 8.10 · source: NVD
MC
Multilin C95 Firmware · GE
before 8.10 · source: NVD
MD
Multilin D30 Firmware · GE
before 8.10 · source: NVD
MD
Multilin D60 Firmware · GE
before 8.10 · source: NVD
MF
Multilin F35 Firmware · GE
before 8.10 · source: NVD
MF
Multilin F60 Firmware · GE
before 8.10 · source: NVD
MG
Multilin G30 Firmware · GE
before 8.10 · source: NVD
MG
Multilin G60 Firmware · GE
before 8.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27420
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27420
Mitigation
https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02
Permissions Required
https://www.gegridsolutions.com/Passport/Login.aspx
More from Multilin B30 Firmware
9.8
CVE-2021-27428
GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup
9.8
CVE-2021-27426
GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a…
7.5
CVE-2021-27422
GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol
6.1
CVE-2021-27418
GE UR firmware versions prior to version 8.1x supports web interface with read-only access
5.3
CVE-2021-27424
GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide