CVE-2019-10966 — MEDIUM (5.3)

Vulnerability Description

In GE Aestiva and Aespire versions 7100 and 7900, a vulnerability exists where serial devices are connected via an added unsecured terminal server to a TCP/IP network configuration, which could allow an attacker to remotely modify device configuration and silence alarms.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Ge	Aestiva 7100 Firmware	-
Ge	Aestiva 7100	-
Ge	Aestiva 7900 Firmware	-
Ge	Aestiva 7900	-
Ge	Aespire 7100 Firmware	-
Ge	Aespire 7100	-
Ge	Aespire 7900 Firmware	-
Ge	Aespire 7900	-

Related Weaknesses (CWE)

CWE-287

References

http://www.securityfocus.com/bid/109102Third Party AdvisoryVDB Entry
https://www.us-cert.gov/ics/advisories/icsma-19-190-01MitigationThird Party AdvisoryUS Government Resource
http://www.securityfocus.com/bid/109102Third Party AdvisoryVDB Entry
https://www.us-cert.gov/ics/advisories/icsma-19-190-01MitigationThird Party AdvisoryUS Government Resource

FAQ

What is CVE-2019-10966?

CVE-2019-10966 is a vulnerability with a CVSS score of 5.3 (MEDIUM). In GE Aestiva and Aespire versions 7100 and 7900, a vulnerability exists where serial devices are connected via an added unsecured terminal server to a TCP/IP network configuration, which could allow ...

How severe is CVE-2019-10966?

CVE-2019-10966 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-10966?

Check the references section above for vendor advisories and patch information. Affected products include: Ge Aestiva 7100 Firmware, Ge Aestiva 7100, Ge Aestiva 7900 Firmware, Ge Aestiva 7900, Ge Aespire 7100 Firmware.