CVE-2022-24118: Critical severity general electric renewable energy inet/inet ii series radio firmware vulnerability

Q: What is CVE-2022-24118?

CVE-2022-24118 is a vulnerability that allows attackers to use a code to trigger a reboot into the factory default configuration in certain General Electric Renewable Energy products.

Q: Which General Electric Renewable Energy products are affected by CVE-2022-24118?

CVE-2022-24118 affects iNET and iNET II before 8.3.0, SD before 6.4.7, TD220X before 2.0.16, and TD220MAX before 1.2.6.

Q: What is the severity of CVE-2022-24118?

CVE-2022-24118 has a severity rating of 9.1 (critical).

Q: How can attackers exploit CVE-2022-24118?

Attackers can exploit CVE-2022-24118 by using a code to trigger a reboot into the factory default configuration.

Q: Is there a fix for CVE-2022-24118?

To fix CVE-2022-24118, update the affected General Electric Renewable Energy products to versions higher than the vulnerable ones mentioned.

Published Dec 26, 2022

Updated

Certain General Electric Renewable Energy products allow attackers to use a code to trigger a reboot into the factory default configuration. This affects iNET and iNET II before 8.3.0, SD before 6.4.7, TD220X before 2.0.16, and TD220MAX before 1.2.6.

Affected Software

20 affected components

General Electric Renewable Energy iNET/iNET II series radio firmware versions prior to rev. 8.3.0

General Electric Renewable Energy SD series radio firmware versions prior to rev. 6.4.7

General Electric Renewable Energy TD220X series radio firmware versions prior to rev. 2.0.16

General Electric Renewable Energy TD220MAX series radio firmware versions prior to rev. 1.2.6

GE Inet 900 Firmware<8.3.0

GE Inet 900

GE Inet Ii 900 Firmware<8.3.0

GE Inet Ii 900

GE Sd1 Firmware<=6.4.7

GE Sd1

GE Sd2 Firmware<6.4.7

GE Sd2

GE Sd4 Firmware<6.4.7

GE Sd4

GE Sd9 Firmware<6.4.7

GE Sd9

GE Td220max Firmware<1.2.6

GE TD220MAX

GE Td220x Firmware<2.0.16

GE TD220X

Remediation

Patch Available

https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-06

Event History

Dec 26, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Aug 3, 2024

Data Sourced

via ICS·04:09 AM

SeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

ICSA-22-090-06

Frequently Asked Questions

What is CVE-2022-24118?

CVE-2022-24118 is a vulnerability that allows attackers to use a code to trigger a reboot into the factory default configuration in certain General Electric Renewable Energy products.

Which General Electric Renewable Energy products are affected by CVE-2022-24118?

CVE-2022-24118 affects iNET and iNET II before 8.3.0, SD before 6.4.7, TD220X before 2.0.16, and TD220MAX before 1.2.6.

What is the severity of CVE-2022-24118?