CVE-2025-27253: Medium severity GE Vernova UR IED vulnerability
A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to bypass firewall rules or to send malicious traffic in the network.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27253?
CVE-2025-27253 has been assigned a high-severity rating due to its potential to allow unauthorized access and manipulation of network traffic.
How do I fix CVE-2025-27253?
To fix CVE-2025-27253, upgrade the GE Vernova UR IED devices to a version later than 8.60 where the input validation issue has been addressed.
What devices are affected by CVE-2025-27253?
CVE-2025-27253 affects GE Vernova UR IED family devices ranging from version 7.0 up to 8.60.
What type of vulnerability is CVE-2025-27253?
CVE-2025-27253 is classified as an improper input validation vulnerability.
Can CVE-2025-27253 lead to remote exploitation?
Yes, CVE-2025-27253 can potentially lead to remote exploitation due to its ability to bypass firewall rules through unauthorized TCP connections.