Critical severity · published Dec 26, 2022
CVE-2022-24117
Certain General Electric Renewable Energy products download firmware without an integrity check
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
Certain General Electric Renewable Energy products download firmware without an integrity check. This affects iNET and iNET II before 8.3.0, SD before 6.4.7, TD220X before 2.0.16, and TD220MAX before 1.2.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
I9
Inet 900 Firmware · GE
before 8.3.0 · source: NVD
II
Inet II 900 Firmware · GE
before 8.3.0 · source: NVD
SF
Sd1 Firmware · GE
through 6.4.7 · source: NVD
SF
Sd2 Firmware · GE
before 6.4.7 · source: NVD
SF
Sd4 Firmware · GE
before 6.4.7 · source: NVD
SF
Sd9 Firmware · GE
before 6.4.7 · source: NVD
TF
Td220max Firmware · GE
before 1.2.6 · source: NVD
TF
Td220x Firmware · GE
before 2.0.16 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-24117
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-24117
Patch
https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-06
More from Inet 900 Firmware
9.8
CVE-2022-24119
Certain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to the device configuration shell
9.8
CVE-2022-24116
Certain General Electric Renewable Energy products have inadequate encryption strength
9.1
CVE-2022-24118
Certain General Electric Renewable Energy products allow attackers to use a code to trigger a reboot into the factory default configuration
4.6
CVE-2022-24120
Certain General Electric Renewable Energy products store cleartext credentials in flash memory