CVE-2021-27428: falha crítica em GE UR family
GE UR family Unrestricted Upload of File with Dangerous Type
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 1.2%
GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without appropriate privileges. The weakness is assessed, and mitigation is implemented in firmware Version 8.10.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
GE · UR familyCVEs relacionadas — GE UR family
No mesmo produto, das mais perigosas para as menos.
CVE-2021-27426CRITICALGE UR family insecure default variable initializationEPSS 1.2%CVE-2021-27420MEDIUMGE UR family input validationEPSS 1.0%CVE-2021-27424MEDIUMGE UR family exposure of sensitive information to an unauthorized actorEPSS 0.9%CVE-2021-27422HIGHGE UR family exposure of sensitive information to an unauthorized actorEPSS 0.7%CVE-2021-27418MEDIUMGE UR family input validationEPSS 0.6%