GE vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2022-43977 An issue was discovered on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0.Critical 9.8 · Jan 17, 2023
• CVE-2022-43976 An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0.Critical 9.8 · Jan 17, 2023
• CVE-2022-43975 An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0.High 7.5 · Jan 17, 2023
• CVE-2022-24119 Certain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to the device configuration shell.Critical 9.8 · Dec 26, 2022
• CVE-2022-24118 Certain General Electric Renewable Energy products allow attackers to use a code to trigger a reboot into the factory default configuration.Critical 9.1 · Dec 26, 2022
• CVE-2022-24117 Certain General Electric Renewable Energy products download firmware without an integrity check.Critical 9.8 · Dec 26, 2022
• CVE-2022-24116 Certain General Electric Renewable Energy products have inadequate encryption strength.Critical 9.8 · Dec 26, 2022
• CVE-2022-3092 GE CIMPICITY versions 2022 and prior is vulnerable to an out-of-bounds write, which could allow an attacker to execute arbitrary code.High 7.8 · Dec 7, 2022
• CVE-2022-3084 GE CIMPICITY versions 2022 and prior is vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiRootOptionTable, which could alHigh 7.8 · Dec 7, 2022
• CVE-2022-2952 GE CIMPICITY versions 2022 and prior is vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could High 7.8 · Dec 7, 2022
• CVE-2022-2948 GE CIMPICITY versions 2022 and prior is vulnerable to a heap-based buffer overflow, which could allow an attacker to execute arbitrary code.High 7.8 · Dec 7, 2022
• CVE-2022-2002 GE CIMPICITY versions 2022 and prior is vulnerable when data from faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could High 7.8 · Dec 7, 2022
• CVE-2020-36549 A vulnerability classified as critical was found in GE Voluson S8.High 8.8 · Jun 17, 2022
• CVE-2021-27430 GE UR bootloader binary Version 7.00, 7.01 and 7.02 included unused hardcoded credentials.High 8.4 · Mar 23, 2022
• CVE-2021-27428 GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup.Critical 9.8 · Mar 23, 2022
• CVE-2021-27426 GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing Critical 9.8 · Mar 23, 2022
• CVE-2021-27422 GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol.High 7.5 · Mar 23, 2022
• CVE-2020-25197 A code injection vulnerability exists in one of the webpages in GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06 that coulCritical 9.8 · Mar 18, 2022
• CVE-2021-31477 This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03.High 7.3 · Jun 16, 2021
• CVE-2021-27454 The software performs an operation at a privilege level higher than the minimum level required, which creates new weaknesses or amplifies the consequences of otHigh 7.8 · Mar 25, 2021
• CVE-2021-27452 The software contains a hard-coded password that could allow an attacker to take control of the merging unit using these hard-coded credentials on the MU320E (aHigh 7.8 · Mar 25, 2021
• CVE-2021-27450 SSH server configuration file does not implement some best practices.High 7.8 · Mar 25, 2021
• CVE-2021-27448 A miscommunication in the file system allows adversaries with access to the MU320E to escalate privileges on the MU320E (all firmware versions prior to v04A00.1High 7.8 · Mar 25, 2021
• CVE-2021-27440 The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components on the Reason DR60 (Critical 9.8 · Mar 25, 2021
• CVE-2021-27438 The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components on the Reason DR60 (High 8.8 · Mar 25, 2021