CVE-2020-12017
First published: Tue Jun 02 2020(Updated: )
GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute arbitrary commands and send a request to a specific URL that could cause the device to become unresponsive. The unauthenticated attacker may change the password of the 'configuration' user account, allowing the attacker to modify the configuration of the device via the web interface using the new password. This vulnerability may also allow an unauthenticated attacker to bypass the authentication required to configure the device and reboot the system.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ge Rt430 Firmware | <08a05 | |
| Ge Rt430 | ||
| Ge Rt431 Firmware | <08a05 | |
| Ge Rt431 | ||
| Ge Rt434 Firmware | <08a05 | |
| Ge Rt434 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-12017?
CVE-2020-12017 is a vulnerability in GE Grid Solutions Reason RT Clocks, specifically models RT430, RT431, and RT434, with firmware versions prior to 08A05.
What is the severity of CVE-2020-12017?
CVE-2020-12017 has a severity rating of 9.8 (critical).
How does CVE-2020-12017 impact the device?
CVE-2020-12017 allows multiple unauthenticated attacks that could cause serious impact on the device.
How can an attacker exploit CVE-2020-12017?
An unauthenticated attacker can exploit CVE-2020-12017 to execute arbitrary code on the device.
Is there a fix available for CVE-2020-12017?
Yes, upgrading the firmware of the GE Grid Solutions Reason RT Clocks to version 08A05 or later resolves the issue.
- collector/nvd-index
- agent/severity
- agent/author
- agent/references
- agent/weakness
- agent/description
- agent/type
- agent/event
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/ge
- canonical/ge rt430 firmware
- canonical/ge rt430
- canonical/ge rt431 firmware
- canonical/ge rt431
- canonical/ge rt434 firmware
- canonical/ge rt434