medium
5.3
CWE
20
Advisory Published
Updated

CVE-2021-27420: GE UR family input validation

First published: Wed Mar 23 2022(Updated: )

GE UR firmware versions prior to version 8.1x web server task does not properly handle receipt of unsupported HTTP verbs, resulting in the web server becoming temporarily unresponsive after receiving a series of unsupported HTTP requests. When unresponsive, the web server is inaccessible. By itself, this is not particularly significant as the relay remains effective in all other functionality and communication channels.

Credit: ics-cert@hq.dhs.gov

Affected SoftwareAffected VersionHow to fix
Ge Multilin B30 Firmware<8.10
Ge Multilin B30
Ge Multilin B90 Firmware<8.10
Ge Multilin B90
Ge Multilin C60 Firmware<8.10
Ge Multilin C60
Ge Multilin C70 Firmware<8.10
Ge Multilin C70
Ge Multilin C95 Firmware<8.10
Ge Multilin C95
Ge Multilin D30 Firmware<8.10
Ge Multilin D30
Ge Multilin D60 Firmware<8.10
Ge Multilin D60
Ge Multilin F35 Firmware<8.10
Ge Multilin F35
Ge Multilin F60 Firmware<8.10
Ge Multilin F60
Ge Multilin G30 Firmware<8.10
Ge Multilin G30
Ge Multilin G60 Firmware<8.10
Ge Multilin G60
Ge Multilin L30 Firmware<8.10
Ge Multilin L30
Ge Multilin L60 Firmware<8.10
Ge Multilin L60
Ge Multilin L90 Firmware<8.10
Ge Multilin L90
Ge Multilin M60 Firmware<8.10
Ge Multilin M60
Ge Multilin N60 Firmware<8.10
Ge Multilin N60
Ge Multilin T35 Firmware<8.10
Ge Multilin T35
Ge Multilin T60 Firmware<8.10
Ge Multilin T60
Ge Multilin C30 Firmware<8.10
Ge Multilin C30
GE Weakness in UR bootloader binary: all bootloader versions prior to 7.03/7.04

Remedy

GE strongly recommends users with impacted firmware versions update their UR devices to UR firmware Version 8.10, or greater to resolve these vulnerabilities. GE provides additional mitigations and information about these vulnerabilities in GE Publication Number: GES-2021-004 (login required).

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is CVE-2021-27420?

    CVE-2021-27420 is a vulnerability in GE UR firmware versions prior to version 8.1x that causes the web server to become temporarily unresponsive after receiving a series of unsupported HTTP requests.

  • How does CVE-2021-27420 affect GE Multilin B30 Firmware?

    GE Multilin B30 Firmware versions prior to 8.10 are affected by CVE-2021-27420.

  • How severe is CVE-2021-27420?

    CVE-2021-27420 has a severity value of 5.3, which is considered medium.

  • How do I fix CVE-2021-27420?

    To fix CVE-2021-27420, update your GE UR firmware version to 8.1x or later.

  • Where can I find more information about CVE-2021-27420?

    You can find more information about CVE-2021-27420 at the following references: [link1](https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02) and [link2](https://www.gegridsolutions.com/Passport/Login.aspx).

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203