CVE-2022-24120: Medium severity general electric renewable energy inet/inet ii series radio firmware vulnerability
Published Dec 26, 2022
·Updated
Certain General Electric Renewable Energy products store cleartext credentials in flash memory. This affects iNET and iNET II before 8.3.0.
Affected Software
20 affected components
General Electric Renewable Energy iNET/iNET II series radio firmware versions prior to rev. 8.3.0
General Electric Renewable Energy SD series radio firmware versions prior to rev. 6.4.7
General Electric Renewable Energy TD220X series radio firmware versions prior to rev. 2.0.16
General Electric Renewable Energy TD220MAX series radio firmware versions prior to rev. 1.2.6
GE Inet 900 Firmware<8.3.0
GE Inet 900
GE Inet Ii 900 Firmware<8.3.0
GE Inet Ii 900
GE Sd1 Firmware<=6.4.7
GE Sd1
GE Sd2 Firmware<6.4.7
GE Sd2
GE Sd4 Firmware<6.4.7
GE Sd4
GE Sd9 Firmware<6.4.7
GE Sd9
GE Td220max Firmware<1.2.6
GE TD220MAX
GE Td220x Firmware<2.0.16
GE TD220X
Remediation
Patch Available
Event History
Dec 26, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Aug 3, 2024
Data Sourced
via ICS·04:09 AM
SeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-24120.
2
Which General Electric Renewable Energy products are affected by this vulnerability?
This vulnerability affects iNET and iNET II products before version 8.3.0.
3
What is the severity of CVE-2022-24120?
CVE-2022-24120 has a severity of medium with a CVSS score of 4.6.
4
How can I fix this vulnerability?
To fix this vulnerability, update the affected iNET and iNET II products to version 8.3.0 or later.
5
Where can I find more information about CVE-2022-24120?
More information about CVE-2022-24120 can be found at the following reference: https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-06