Ge Multilin c95 Firmware vulnerabilities

6 CVEs affecting Ge Multilin c95 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-27428, published 2022-03-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-27428, published 2022-03-23. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of…
CVE-2021-27426, published 2022-03-23. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a “Factory” user.
CVE-2021-27420, published 2022-03-23. Medium severity, CVSS 5.3. EPSS: 1.1% chance of exploitation in the next 30 days. GE UR firmware versions prior to version 8.1x web server task does not properly handle receipt of unsupported HTTP verbs, resulting in the web server becoming temporarily unresponsive after receiving…
CVE-2021-27424, published 2022-03-23. Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days. GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. GE was made aware a “Last-key pressed” MODBUS register can be used to gain unauthorized…
CVE-2021-27422, published 2022-03-23. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol. It allows sensitive information exposure without authentication.
CVE-2021-27418, published 2022-03-23. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting…