Login Request a demo
Medium severity · published Mar 10, 2025
CVE-2025-27257
Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware. The firmware signature verification is enforced only on the client-side dedicated software Enervista UR Setup, allowing the integration check to be bypassed.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BM
B30 Multilin · GE Vernova
7.0 through 8.60 · source: vendor
BM
B90 Multilin · GE Vernova
7.0 through 8.60 · source: vendor
CM
C30 Multilin · GE Vernova
7.0 through 8.60 · source: vendor
CM
C60 Multilin · GE Vernova
7.0 through 8.60 · source: vendor
CM
C70 Multilin · GE Vernova
7.0 through 8.60 · source: vendor
CM
C95 Multilin · GE Vernova
7.0 through 8.60 · source: vendor
DM
D30 Multilin · GE Vernova
7.0 through 8.60 · source: vendor
DM
D60 Multilin · GE Vernova
7.0 through 8.60 · source: vendor
FM
F35 Multilin · GE Vernova
7.0 through 8.60 · source: vendor
FM
F60 Multilin · GE Vernova
7.0 through 8.60 · source: vendor
GM
G30 Multilin · GE Vernova
7.0 through 8.60 · source: vendor
GM
G60 Multilin · GE Vernova
7.0 through 8.60 · source: vendor
Affected product
BM
B30 Multilin
GE Vernova
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27257
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27257
www.gevernova.com
https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76
www.nozominetworks.com
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27257
More from B30 Multilin
6.1
CVE-2025-27253
A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes…