Description
A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to bypass firewall rules or to send malicious traffic in the network.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GE Vernova | N60 multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | B30 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | B90 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | C30 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | C60 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | C70 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | C95 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | D30 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | D60 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | F35 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | F60 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | G30 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | G60 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | L30 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | L60 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | L90 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | M60 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | T35 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | T60 Multilin | 7.0 – ≤ 8.60 | — |