Description
Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware.
The firmware signature verification is enforced only on the client-side dedicated software Enervista UR Setup, allowing the integration check to be bypassed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GE Vernova | N60 multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | B30 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | B90 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | C30 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | C60 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | C70 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | C95 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | D30 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | D60 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | F35 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | F60 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | G30 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | G60 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | L30 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | L60 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | L90 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | M60 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | T35 Multilin | 7.0 – ≤ 8.60 | — |
| GE Vernova | T60 Multilin | 7.0 – ≤ 8.60 | — |