Critical severity · published Mar 23, 2022
CVE-2021-27428
GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup
9.8
CVSS
1.2%
EPSS
No
On KEV
Description
GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without appropriate privileges. The weakness is assessed, and mitigation is implemented in firmware Version 8.10.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MB
Multilin B30 Firmware · GE
before 8.10 · source: NVD
MB
Multilin B90 Firmware · GE
before 8.10 · source: NVD
MC
Multilin C30 Firmware · GE
before 8.10 · source: NVD
MC
Multilin C60 Firmware · GE
before 8.10 · source: NVD
MC
Multilin C70 Firmware · GE
before 8.10 · source: NVD
MC
Multilin C95 Firmware · GE
before 8.10 · source: NVD
MD
Multilin D30 Firmware · GE
before 8.10 · source: NVD
MD
Multilin D60 Firmware · GE
before 8.10 · source: NVD
MF
Multilin F35 Firmware · GE
before 8.10 · source: NVD
MF
Multilin F60 Firmware · GE
before 8.10 · source: NVD
MG
Multilin G30 Firmware · GE
before 8.10 · source: NVD
MG
Multilin G60 Firmware · GE
before 8.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27428
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27428
Mitigation
https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02
Permissions Required
https://www.gegridsolutions.com/Passport/Login.aspx
More from Multilin B30 Firmware
9.8
CVE-2021-27426
GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a…
7.5
CVE-2021-27422
GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol
6.1
CVE-2021-27418
GE UR firmware versions prior to version 8.1x supports web interface with read-only access
5.3
CVE-2021-27424
GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide
5.3
CVE-2021-27420
GE UR firmware versions prior to version 8.1x web server task does not properly handle receipt of unsupported HTTP verbs, resulting in the web server becoming temporarily…