Unscored BSI-2022-0005 3 CVEs

Multiple Vulnerabilities in GE MS 3000

Published Nov 2, 2022 · Updated Nov 2, 2022

Vendor: GE Grid Solutions Product: MS 3000 Product: MS 3000 firmware

Summary

E.ON Pentesting Team has found several vulnerabilities in the firmware of GE Grid Solution's MS 3000. These include an unprotected and open debug service, web service access without authentication or encryption and directory traversal.

Product

The MS 3000 is an online condition monitoring and expert system for transformers. It includes a web-based interface as well as a wide range of communication protocols (including IEC 61850).

Vulnerabilities 3

Critical 9.8

CVE-2022-43976

An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. Direc…

Jan 17, 2023
Critical 9.8

CVE-2022-43977

An issue was discovered on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. The debug port accessib…

Jan 17, 2023
High 7.5

CVE-2022-43975

An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. A vul…

Jan 17, 2023

Revision history

2022-11-02 #1
Initial version.

References

GE Grid Solutions advisory - GES-2021-011
https://www.gegridsolutions.com/app/viewfiles.aspx?prod=ms3000&type=21
GE Grid Solutions - Product page
https://www.gegridsolutions.com/md/catalog/ms3000.htm