CVE-2021-27422 — HIGH (7.5)

Q: What is CVE-2021-27422?

CVE-2021-27422 is a vulnerability with a CVSS score of 7.5 (HIGH). GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol. It allows sensitive information exposure without authentication.

Q: How severe is CVE-2021-27422?

CVE-2021-27422 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2021-27422?

Check the references section above for vendor advisories and patch information. Affected products include: Ge Multilin B30 Firmware, Ge Multilin B30, Ge Multilin B90 Firmware, Ge Multilin B90, Ge Multilin C60 Firmware.

Vulnerability Description

GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol. It allows sensitive information exposure without authentication.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Ge	Multilin B30 Firmware	< 8.10
Ge	Multilin B30	-
Ge	Multilin B90 Firmware	< 8.10
Ge	Multilin B90	-
Ge	Multilin C60 Firmware	< 8.10
Ge	Multilin C60	-
Ge	Multilin C70 Firmware	< 8.10
Ge	Multilin C70	-
Ge	Multilin C95 Firmware	< 8.10
Ge	Multilin C95	-
Ge	Multilin D30 Firmware	< 8.10
Ge	Multilin D30	-
Ge	Multilin D60 Firmware	< 8.10
Ge	Multilin D60	-
Ge	Multilin F35 Firmware	< 8.10
Ge	Multilin F35	-
Ge	Multilin F60 Firmware	< 8.10
Ge	Multilin F60	-
Ge	Multilin G30 Firmware	< 8.10
Ge	Multilin G30	-

Related Weaknesses (CWE)

CWE-319 CWE-200

References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02MitigationThird Party AdvisoryUS Government Resource
https://www.gegridsolutions.com/Passport/Login.aspxPermissions RequiredVendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02MitigationThird Party AdvisoryUS Government Resource
https://www.gegridsolutions.com/Passport/Login.aspxPermissions RequiredVendor Advisory

FAQ

What is CVE-2021-27422?

CVE-2021-27422 is a vulnerability with a CVSS score of 7.5 (HIGH). GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol. It allows sensitive information exposure without authentication.

How severe is CVE-2021-27422?

CVE-2021-27422 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-27422?

Check the references section above for vendor advisories and patch information. Affected products include: Ge Multilin B30 Firmware, Ge Multilin B30, Ge Multilin B90 Firmware, Ge Multilin B90, Ge Multilin C60 Firmware.