Vulnerability · Published Mar 10, 2025 · Assigned by Nozomi
CVE-2025-27255
High 8.0
In plain English
A high-severity hard-coded credentials in EnerVista UR Setup from GE Vernova. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities).
Severity (CVSS 3.1)8.0High
Exploit odds (30 days)0.2%top 95.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Use of Hard-coded Credentials vulnerability in GE Vernova EnerVista UR Setup allows Privilege Escalation. The local user database is encrypted using an hardcoded password retrievable by an attacker analyzing the application code.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| GE Vernova | EnerVista UR Setup | 8.42 |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H