CVE-2021-27424

GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. GE was made aware a “Last-key pressed” MODBUS register can be used to gain unauthorized information.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02	Mitigation Third Party Advisory US Government Resource
https://www.gegridsolutions.com/Passport/Login.aspx	Permissions Required Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:ge:multilin_b30_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:multilin_b30:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:ge:multilin_b90_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:multilin_b90:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:ge:multilin_c60_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:multilin_c60:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:ge:multilin_c70_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:multilin_c70:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:ge:multilin_c95_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:multilin_c95:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND

cpe:2.3:o:ge:multilin_d30_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:multilin_d30:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND

cpe:2.3:o:ge:multilin_d60_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:multilin_d60:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND

cpe:2.3:o:ge:multilin_f35_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:multilin_f35:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND

cpe:2.3:o:ge:multilin_f60_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:multilin_f60:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND

cpe:2.3:o:ge:multilin_g30_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:multilin_g30:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND

cpe:2.3:o:ge:multilin_g60_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:multilin_g60:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND

cpe:2.3:o:ge:multilin_l30_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:multilin_l30:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND

cpe:2.3:o:ge:multilin_l60_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:multilin_l60:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND

cpe:2.3:o:ge:multilin_l90_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:multilin_l90:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND

cpe:2.3:o:ge:multilin_m60_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:multilin_m60:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND

cpe:2.3:o:ge:multilin_n60_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:multilin_n60:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND

cpe:2.3:o:ge:multilin_t35_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:multilin_t35:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND

cpe:2.3:o:ge:multilin_t60_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:multilin_t60:-:*:*:*:*:*:*:*

Configuration 19 (hide)

AND

cpe:2.3:o:ge:multilin_c30_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:multilin_c30:-:*:*:*:*:*:*:*

History

01 Apr 2022, 18:19

Type	Values Removed	Values Added
CPE		cpe:2.3:h:ge:multilin_d30:-:::::::* cpe:2.3:o:ge:multilin_b30_firmware:::::::: cpe:2.3:o:ge:multilin_c60_firmware:::::::: cpe:2.3:o:ge:multilin_g60_firmware:::::::: cpe:2.3:o:ge:multilin_m60_firmware:::::::: cpe:2.3:h:ge:multilin_n60:-:::::::* cpe:2.3:h:ge:multilin_t60:-:::::::* cpe:2.3:o:ge:multilin_g30_firmware:::::::: cpe:2.3:h:ge:multilin_g60:-:::::::* cpe:2.3:o:ge:multilin_c30_firmware:::::::: cpe:2.3:o:ge:multilin_d30_firmware:::::::: cpe:2.3:o:ge:multilin_b90_firmware:::::::: cpe:2.3:h:ge:multilin_c70:-:::::::* cpe:2.3:h:ge:multilin_d60:-:::::::* cpe:2.3:h:ge:multilin_g30:-:::::::* cpe:2.3:h:ge:multilin_t35:-:::::::* cpe:2.3:h:ge:multilin_l60:-:::::::* cpe:2.3:o:ge:multilin_l90_firmware:::::::: cpe:2.3:o:ge:multilin_c95_firmware:::::::: cpe:2.3:h:ge:multilin_c95:-:::::::* cpe:2.3:h:ge:multilin_l30:-:::::::* cpe:2.3:h:ge:multilin_f35:-:::::::* cpe:2.3:o:ge:multilin_t35_firmware:::::::: cpe:2.3:o:ge:multilin_t60_firmware:::::::: cpe:2.3:h:ge:multilin_c30:-:::::::* cpe:2.3:h:ge:multilin_b90:-:::::::* cpe:2.3:h:ge:multilin_c60:-:::::::* cpe:2.3:o:ge:multilin_f35_firmware:::::::: cpe:2.3:o:ge:multilin_l30_firmware:::::::: cpe:2.3:h:ge:multilin_f60:-:::::::* cpe:2.3:h:ge:multilin_l90:-:::::::* cpe:2.3:h:ge:multilin_m60:-:::::::* cpe:2.3:o:ge:multilin_c70_firmware:::::::: cpe:2.3:h:ge:multilin_b30:-:::::::* cpe:2.3:o:ge:multilin_d60_firmware:::::::: cpe:2.3:o:ge:multilin_n60_firmware:::::::: cpe:2.3:o:ge:multilin_l60_firmware:::::::: cpe:2.3:o:ge:multilin_f60_firmware::::::::
First Time		Ge multilin N60 Firmware Ge multilin L60 Firmware Ge multilin C30 Firmware Ge multilin F60 Firmware Ge multilin C95 Ge multilin T60 Firmware Ge multilin G60 Ge multilin L90 Ge multilin C70 Firmware Ge multilin T35 Firmware Ge multilin B90 Firmware Ge multilin F35 Ge multilin C60 Ge multilin N60 Ge multilin B30 Firmware Ge multilin G30 Firmware Ge multilin L30 Ge multilin B90 Ge multilin T35 Ge multilin T60 Ge multilin M60 Ge multilin D30 Ge multilin C70 Ge multilin C95 Firmware Ge multilin D30 Firmware Ge multilin C60 Firmware Ge Ge multilin G60 Firmware Ge multilin G30 Ge multilin M60 Firmware Ge multilin F60 Ge multilin L90 Firmware Ge multilin F35 Firmware Ge multilin L60 Ge multilin D60 Firmware Ge multilin B30 Ge multilin C30 Ge multilin D60 Ge multilin L30 Firmware
CWE		CWE-668
References	~~(CONFIRM) https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02 -~~	(CONFIRM) https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02 - Mitigation, Third Party Advisory, US Government Resource
References	~~(CONFIRM) https://www.gegridsolutions.com/Passport/Login.aspx -~~	(CONFIRM) https://www.gegridsolutions.com/Passport/Login.aspx - Permissions Required, Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 5.0 v3 : 5.3

23 Mar 2022, 20:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-03-23 20:15

Updated : 2023-12-10 14:22

NVD link : CVE-2021-27424

Mitre link : CVE-2021-27424

CVE.ORG link : CVE-2021-27424

JSON object : View

Products Affected

multilin_l30
multilin_f60
multilin_g60_firmware
multilin_g30_firmware
multilin_c30
multilin_m60
multilin_f35_firmware
multilin_t60
multilin_g60
multilin_c60
multilin_g30
multilin_t60_firmware
multilin_f60_firmware
multilin_l90_firmware
multilin_b90
multilin_c95_firmware
multilin_d30
multilin_l30_firmware
multilin_n60
multilin_c30_firmware
multilin_b30
multilin_t35_firmware
multilin_f35
multilin_b90_firmware
multilin_d30_firmware
multilin_c70
multilin_n60_firmware
multilin_m60_firmware
multilin_l60
multilin_c95
multilin_d60_firmware
multilin_d60
multilin_c60_firmware
multilin_l60_firmware
multilin_l90
multilin_b30_firmware
multilin_t35
multilin_c70_firmware

CWE

CWE-668

Exposure of Resource to Wrong Sphere

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

5.3 /10

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0 /10

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

JSON object

Attach tags to CVE-2021-27424

5.3^/10

5.0^/10

Attach tags to `CVE-2021-27424`