CVE-2021-27420: GE UR family input validation

Q: What is CVE-2021-27420?

CVE-2021-27420 is a vulnerability in GE UR firmware versions prior to version 8.1x that causes the web server to become temporarily unresponsive after receiving a series of unsupported HTTP requests.

Q: How does CVE-2021-27420 affect GE Multilin B30 Firmware?

GE Multilin B30 Firmware versions prior to 8.10 are affected by CVE-2021-27420.

Q: How severe is CVE-2021-27420?

CVE-2021-27420 has a severity value of 5.3, which is considered medium.

Q: How do I fix CVE-2021-27420?

To fix CVE-2021-27420, update your GE UR firmware version to 8.1x or later.

Q: Where can I find more information about CVE-2021-27420?

You can find more information about CVE-2021-27420 at the following references: [link1](https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02) and [link2](https://www.gegridsolutions.com/Passport/Login.aspx).

Published Mar 23, 2022

Updated

GE UR firmware versions prior to version 8.1x web server task does not properly handle receipt of unsupported HTTP verbs, resulting in the web server becoming temporarily unresponsive after receiving a series of unsupported HTTP requests. When unresponsive, the web server is inaccessible. By itself, this is not particularly significant as the relay remains effective in all other functionality and communication channels.

Affected Software

44 affected components

GE Vulnerabilities related to SSH Support: firmware versions 7.4x to 8.0x (CyberSentry option)

GE Web server vulnerabilities: all firmware versions prior to version 8.1x

GE Protection from unintended firmware upload: all firmware versions prior to 8.1x with basic security option

GE Provisions to disable Factory Mode: all firmware versions prior to 8.1x with basic security option

GE Access to “Last-key pressed” register: all firmware versions prior to 8.1x with basic security option

GE Weakness in UR bootloader binary: all bootloader versions prior to 7.03/7.04

GE Multilin B30 Firmware<8.10

GE Multilin B30

GE Multilin B90 Firmware<8.10

GE Multilin B90

GE Multilin C60 Firmware<8.10

GE Multilin C60

GE Multilin C70 Firmware<8.10

GE Multilin C70

GE Multilin C95 Firmware<8.10

GE Multilin C95

GE Multilin D30 Firmware<8.10

GE Multilin D30

GE Multilin D60 Firmware<8.10

GE Multilin D60

GE Multilin F35 Firmware<8.10

GE Multilin F35

GE Multilin F60 Firmware<8.10

GE Multilin F60

GE Multilin G30 Firmware<8.10

GE Multilin G30

GE Multilin G60 Firmware<8.10

GE Multilin G60

GE Multilin L30 Firmware<8.10

GE Multilin L30

GE Multilin L60 Firmware<8.10

GE Multilin L60

GE Multilin L90 Firmware<8.10

GE Multilin L90

GE Multilin M60 Firmware<8.10

GE Multilin M60

GE Multilin N60 Firmware<8.10

GE Multilin N60

GE Multilin T35 Firmware<8.10

GE Multilin T35

GE Multilin T60 Firmware<8.10

GE Multilin T60

GE Multilin C30 Firmware<8.10

GE Multilin C30

Remediation

Information

GE strongly recommends users with impacted firmware versions update their UR devices to UR firmware Version 8.10, or greater to resolve these vulnerabilities. GE provides additional mitigations and information about these vulnerabilities in GE Publication Number: GES-2021-004 (login required).

Event History

Mar 23, 2022

CVE Published

via MITRE·07:46 PM

Data Sourced

via MITRE·07:46 PM

RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-21-075-02

Frequently Asked Questions

What is CVE-2021-27420?

CVE-2021-27420 is a vulnerability in GE UR firmware versions prior to version 8.1x that causes the web server to become temporarily unresponsive after receiving a series of unsupported HTTP requests.

How does CVE-2021-27420 affect GE Multilin B30 Firmware?

GE Multilin B30 Firmware versions prior to 8.10 are affected by CVE-2021-27420.

How severe is CVE-2021-27420?