CVE-2017-7905: Weak Encryption
A Weak Cryptography for Passwords issue was discovered in General Electric (GE) Multilin SR 750 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 760 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 469 Motor Protection Relay, firmware versions prior to Version 5.23; SR 489 Generator Protection Relay, firmware versions prior to Version 4.06; SR 745 Transformer Protection Relay, firmware versions prior to Version 5.23; SR 369 Motor Protection Relay, all firmware versions; Multilin Universal Relay, firmware Version 6.0 and prior versions; and Multilin URplus (D90, C90, B95), all versions. Ciphertext versions of user passwords were created with a non-random initialization vector leaving them susceptible to dictionary attacks. Ciphertext of user passwords can be obtained from the front LCD panel of affected products and through issued Modbus commands.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7905?
CVE-2017-7905 has a medium severity rating due to its weak cryptography for passwords in affected GE relay firmware.
How do I fix CVE-2017-7905?
To fix CVE-2017-7905, users should upgrade to firmware version 7.47 or later for affected GE Multilin devices.
Which GE devices are affected by CVE-2017-7905?
CVE-2017-7905 affects GE Multilin SR 750, SR 760, SR 469, SR 489, SR 745, and other specific protection relay firmware versions before specified updates.
What is the impact of CVE-2017-7905?
The impact of CVE-2017-7905 includes potential unauthorized access to system components due to weak password encryption.
Is CVE-2017-7905 related to any known exploits?
As of now, there are no public reports of exploits utilizing CVE-2017-7905, but the vulnerability poses a security risk that should be addressed.