Medium severity · published Dec 26, 2022
CVE-2022-24120
Certain General Electric Renewable Energy products store cleartext credentials in flash memory
4.6
CVSS
0.2%
EPSS
No
On KEV
Description
Certain General Electric Renewable Energy products store cleartext credentials in flash memory. This affects iNET and iNET II before 8.3.0.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
I9
Inet 900 Firmware · GE
before 8.3.0 · source: NVD
II
Inet II 900 Firmware · GE
before 8.3.0 · source: NVD
SF
Sd1 Firmware · GE
through 6.4.7 · source: NVD
SF
Sd2 Firmware · GE
before 6.4.7 · source: NVD
SF
Sd4 Firmware · GE
before 6.4.7 · source: NVD
SF
Sd9 Firmware · GE
before 6.4.7 · source: NVD
TF
Td220max Firmware · GE
before 1.2.6 · source: NVD
TF
Td220x Firmware · GE
before 2.0.16 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-24120
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-24120
Patch
https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-06
More from Inet 900 Firmware
9.8
CVE-2022-24119
Certain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to the device configuration shell
9.8
CVE-2022-24117
Certain General Electric Renewable Energy products download firmware without an integrity check
9.8
CVE-2022-24116
Certain General Electric Renewable Energy products have inadequate encryption strength
9.1
CVE-2022-24118
Certain General Electric Renewable Energy products allow attackers to use a code to trigger a reboot into the factory default configuration