Where
-Infinity
0

Trending

Last week
Last month
Last year

Versions

4.2.1
3

GE Multilink Ml3100 FirmwareGE Multilink Use of Hard-coded Cryptographic Key

Risk 87
Severity
10
AV:N/AC:L/Au:N/C:P/I:N/A:N

GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier use the same RSA private key across different customers' installations, which makes it easier for remote attackers to obtain the cleartext content of network traffic by reading this key from a firmware image and then sniffing the network.

Remedy

GE recommends users update switch firmware to the latest published version to resolve these vulnerabilities. The new firmware will enable new keys to be calculated and exchanged, resolve the slow data transfer and potential denial of service, and prevent the identified cross-site scripting vulnerabilities. The latest firmware is Version 5.3.2 for the ML800, ML1200, ML1600 and ML2400 and Version 5.3.2-3K for the ML810, ML3000, and ML3100. This firmware is available through the “Resources/Software” link in the product web sites at http://www.gedigitalenergy.com . This firmware is also available through the EnerVista Launchpad device management tool. GE recommends updating the switch over a serial connection to prevent an attacker from capturing the new key. Please refer to the GE advisory for specific information on how to install the firmware and change RSA key. The GE advisory is available at: https://www.gedigitalenergy.com/products/support/multilink/MLSB0415.pdf
First published (updated )
CVE-2014-5419

GE Multilink Ml810 FirmwareGE Multilink Uncontrolled Resource Consumption

Risk 44
Severity
7.8
AV:N/AC:L/Au:N/C:N/I:N/A:C

GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier allow remote attackers to cause a denial of service (resource consumption or reboot) via crafted packets.

Remedy

GE recommends users update switch firmware to the latest published version to resolve these vulnerabilities. The new firmware will enable new keys to be calculated and exchanged, resolve the slow data transfer and potential denial of service, and prevent the identified cross-site scripting vulnerabilities. The latest firmware is Version 5.3.2 for the ML800, ML1200, ML1600 and ML2400 and Version 5.3.2-3K for the ML810, ML3000, and ML3100. This firmware is available through the “Resources/Software” link in the product web sites at http://www.gedigitalenergy.com . This firmware is also available through the EnerVista Launchpad device management tool. GE recommends updating the switch over a serial connection to prevent an attacker from capturing the new key. Please refer to the GE advisory for specific information on how to install the firmware and change RSA key. The GE advisory is available at: https://www.gedigitalenergy.com/products/support/multilink/MLSB0415.pdf
First published (updated )
CVE-2014-5418

GE Multilink Ml810 FirmwareGE Multilink Cross-site Scripting

Risk 38
Severity
6.8
XSS
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability in GE Multilink ML810/3000/3100 series switch 5.2.0 and earlier, and GE Multilink ML800/1200/1600/2400 4.2.1 and earlier.

Remedy

GE recommends users update switch firmware to the latest published version to resolve these vulnerabilities. The new firmware will enable new keys to be calculated and exchanged, resolve the slow data transfer and potential denial of service, and prevent the identified cross-site scripting vulnerabilities. The latest firmware is Version 5.3.2 for the ML800, ML1200, ML1600 and ML2400 and Version 5.3.2-3K for the ML810, ML3000, and ML3100. This firmware is available through the “Resources/Software” link in the product web sites at http://www.gedigitalenergy.com . This firmware is also available through the EnerVista Launchpad device management tool. GE recommends updating the switch over a serial connection to prevent an attacker from capturing the new key. Please refer to the GE advisory for specific information on how to install the firmware and change RSA key. The GE advisory is available at: https://www.gedigitalenergy.com/products/support/multilink/MLSB0415.pdf
First published (updated )
CVE-2015-3976

GE Multilink FirmwareGeneral Electric (GE) Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware before 5.5.…

Risk 87
Severity
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

General Electric (GE) Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware before 5.5.0 and ML810, ML3000, and ML3100 switches with firmware before 5.5.0k have hardcoded credentials, which allows remote attackers to modify configuration settings via the web interface.

First published (updated )
CVE-2016-2310

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203