High severity · published Mar 23, 2022
CVE-2021-27422
GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol. It allows sensitive information exposure without authentication.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MB
Multilin B30 Firmware · GE
before 8.10 · source: NVD
MB
Multilin B90 Firmware · GE
before 8.10 · source: NVD
MC
Multilin C30 Firmware · GE
before 8.10 · source: NVD
MC
Multilin C60 Firmware · GE
before 8.10 · source: NVD
MC
Multilin C70 Firmware · GE
before 8.10 · source: NVD
MC
Multilin C95 Firmware · GE
before 8.10 · source: NVD
MD
Multilin D30 Firmware · GE
before 8.10 · source: NVD
MD
Multilin D60 Firmware · GE
before 8.10 · source: NVD
MF
Multilin F35 Firmware · GE
before 8.10 · source: NVD
MF
Multilin F60 Firmware · GE
before 8.10 · source: NVD
MG
Multilin G30 Firmware · GE
before 8.10 · source: NVD
MG
Multilin G60 Firmware · GE
before 8.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27422
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27422
Mitigation
https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02
Permissions Required
https://www.gegridsolutions.com/Passport/Login.aspx
More from Multilin B30 Firmware
9.8
CVE-2021-27428
GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup
9.8
CVE-2021-27426
GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a…
6.1
CVE-2021-27418
GE UR firmware versions prior to version 8.1x supports web interface with read-only access
5.3
CVE-2021-27424
GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide
5.3
CVE-2021-27420
GE UR firmware versions prior to version 8.1x web server task does not properly handle receipt of unsupported HTTP verbs, resulting in the web server becoming temporarily…