Critical ICSA-21-082-03 3 CVEs

GE Reason DR60

Published Mar 23, 2021 · Updated Mar 23, 2021

Vendor: General Electric (GE) Product: DR60

Summary

Successful exploitation of these vulnerabilities could allow an attacker to take full control of the digital fault recorder (DFR), remotely execute code, or escalate privileges.

Vulnerabilities 3

Unscored —

CVE-2021-27438

The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to…

Mar 25, 2021
Unscored —

CVE-2021-27440

The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to…

Mar 25, 2021
Unscored —

CVE-2021-27454

The software performs an operation at a privilege level higher than the minimum level required, which creates new weakn…

Mar 25, 2021

Revision history

2021-03-23 #1
ICSA-21-082-03 GE Reason DR60

References

ICS Advisory ICSA-21-082-03 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-082-03
Recommended Practices
https://us-cert.cisa.gov/ncas/tips/ST04-014
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B