Critical severity · published Mar 23, 2022
CVE-2021-27428
GE UR family Unrestricted Upload of File with Dangerous Type
9.8
CVSS
1.2%
EPSS
No
On KEV
Description
GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without appropriate privileges. The weakness is assessed, and mitigation is implemented in firmware Version 8.10.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UF
UR family · GE
before 8.1x · source: vendor
MB
Multilin B30 Firmware · GE
before 8.10 · source: NVD
MB
Multilin B90 Firmware · GE
before 8.10 · source: NVD
MC
Multilin C30 Firmware · GE
before 8.10 · source: NVD
MC
Multilin C60 Firmware · GE
before 8.10 · source: NVD
MC
Multilin C70 Firmware · GE
before 8.10 · source: NVD
MC
Multilin C95 Firmware · GE
before 8.10 · source: NVD
MD
Multilin D30 Firmware · GE
before 8.10 · source: NVD
MD
Multilin D60 Firmware · GE
before 8.10 · source: NVD
MF
Multilin F35 Firmware · GE
before 8.10 · source: NVD
MF
Multilin F60 Firmware · GE
before 8.10 · source: NVD
MG
Multilin G30 Firmware · GE
before 8.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27428
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27428
Mitigation
https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02
Permissions Required
https://www.gegridsolutions.com/Passport/Login.aspx
More from UR family
9.8
CVE-2021-27426
GE UR family insecure default variable initialization
7.5
CVE-2021-27422
GE UR family exposure of sensitive information to an unauthorized actor
6.1
CVE-2021-27418
GE UR family input validation
5.3
CVE-2021-27424
GE UR family exposure of sensitive information to an unauthorized actor
5.3
CVE-2021-27420
GE UR family input validation