Vulnerability · Published Mar 23, 2022 · Assigned by icscert

CVE-2021-27418GE UR family input validation

Medium 5.3

In plain English

A medium-severity improper input validation in UR family from GE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.6%top 50.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting attacks, which may be used to send a malicious script. Also, UR Firmware web server does not perform HTML encoding of user-supplied strings.

Affected products (as reported)

Vendor	Product	Versions
GE	UR family	unspecified – before 8.1x

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02 x_refsource_CONFIRM
https://www.gegridsolutions.com/Passport/Login.aspx x_refsource_CONFIRM