Vulnerability · Published Mar 23, 2022 · Assigned by icscert

CVE-2021-27420GE UR family input validation

Medium 5.3

In plain English

A medium-severity improper input validation in UR family from GE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)1.1%top 35.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GE UR firmware versions prior to version 8.1x web server task does not properly handle receipt of unsupported HTTP verbs, resulting in the web server becoming temporarily unresponsive after receiving a series of unsupported HTTP requests. When unresponsive, the web server is inaccessible. By itself, this is not particularly significant as the relay remains effective in all other functionality and communication channels.

Affected products (as reported)

Vendor	Product	Versions
GE	UR family	unspecified – before 8.1x

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02 x_refsource_CONFIRM
https://www.gegridsolutions.com/Passport/Login.aspx x_refsource_CONFIRM