CVE-2021-27424: GE UR family exposure of sensitive information to an unauthorized actor
Published Mar 23, 2022
·Updated
GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. GE was made aware a “Last-key pressed” MODBUS register can be used to gain unauthorized information.
Affected Software
44 affected components
GE Vulnerabilities related to SSH Support: firmware versions 7.4x to 8.0x (CyberSentry option)
GE Web server vulnerabilities: all firmware versions prior to version 8.1x
GE Protection from unintended firmware upload: all firmware versions prior to 8.1x with basic security option
GE Provisions to disable Factory Mode: all firmware versions prior to 8.1x with basic security option
GE Access to “Last-key pressed” register: all firmware versions prior to 8.1x with basic security option
GE Weakness in UR bootloader binary: all bootloader versions prior to 7.03/7.04
GE Multilin B30 Firmware<8.10
GE Multilin B30
GE Multilin B90 Firmware<8.10
GE Multilin B90
GE Multilin C60 Firmware<8.10
GE Multilin C60
GE Multilin C70 Firmware<8.10
GE Multilin C70
GE Multilin C95 Firmware<8.10
GE Multilin C95
GE Multilin D30 Firmware<8.10
GE Multilin D30
GE Multilin D60 Firmware<8.10
GE Multilin D60
GE Multilin F35 Firmware<8.10
GE Multilin F35
GE Multilin F60 Firmware<8.10
GE Multilin F60
GE Multilin G30 Firmware<8.10
GE Multilin G30
GE Multilin G60 Firmware<8.10
GE Multilin G60
GE Multilin L30 Firmware<8.10
GE Multilin L30
GE Multilin L60 Firmware<8.10
GE Multilin L60
GE Multilin L90 Firmware<8.10
GE Multilin L90
GE Multilin M60 Firmware<8.10
GE Multilin M60
GE Multilin N60 Firmware<8.10
GE Multilin N60
GE Multilin T35 Firmware<8.10
GE Multilin T35
GE Multilin T60 Firmware<8.10
GE Multilin T60
GE Multilin C30 Firmware<8.10
GE Multilin C30
Remediation
Information
GE strongly recommends users with impacted firmware versions update their UR devices to UR firmware Version 8.10, or greater to resolve these vulnerabilities. GE provides additional mitigations and information about these vulnerabilities in GE Publication Number: GES-2021-004 (login required).
Event History
Mar 23, 2022
CVE Published
via MITRE·07:46 PM
Data Sourced
via MITRE·07:46 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2021-27424.
2
What is the severity level of CVE-2021-27424?
CVE-2021-27424 has a severity level of 5.3 (Medium).
3
How does CVE-2021-27424 affect GE UR firmware versions?
CVE-2021-27424 affects GE UR firmware versions prior to version 8.10.
4
What is the impact of CVE-2021-27424?
CVE-2021-27424 allows an attacker to gain unauthorized information by exploiting a "Last-key pressed" MODBUS register.
5
Where can I find more information about CVE-2021-27424?
You can find more information about CVE-2021-27424 at the following references: [Reference 1](https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02) and [Reference 2](https://www.gegridsolutions.com/Passport/Login.aspx).