Description
GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting attacks, which may be used to send a malicious script. Also, UR Firmware web server does not perform HTML encoding of user-supplied strings.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GE | UR family | unspecified – < 8.1x | 8.1x |
Advisories 1
- ICSA-21-075-02 GE UR Family (Update A) CISA ICS & IT advisories · Apr 16, 2026