Skip to content
OpenAdvisories
Critical ICSA-21-005-03 2 CVEs

GE Reason RT43X Clocks

Published Jan 5, 2021 · Updated Jan 5, 2021

Vendor: General Electric (GE) Product: RT430 RT431 & RT434

Summary

Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary code on the system or intercept and decrypt encrypted traffic.

Vulnerabilities 2

  • Critical 9.8
    CVE-2020-25197

    GE Reason RT43X Clocks Code Injection

    A code injection vulnerability exists in one of the webpages in GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06 that could allow an authenticated remote attacker to execute arbitrary code on the system.

    GE Reason RT43X Clocks
  • Medium 5.3
    CVE-2020-25193

    GE Reason RT43X Clocks Use of Hard-coded Cryptographic Key

    By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06, attackers would be able to intercept and decrypt encrypted traffic through an HTTPS connection.

    GE Reason RT43X Clocks

Revision history

  1. #1

    ICSA-21-005-03 GE Reason RT43X Clocks

References