CVE-2021-27424
Assigner: icscert
Published: 2022-03-23T19:46:25
State: PUBLISHED
affected: product: UR family
vendor: GE
versions: lessThan: 8.1x
status: affected
version: unspecified
versionType: custom
credits: value: SCADA-X, DOE’s Cyber Testing for Resilient Industrial Control Systems (CyTRICS) program, Verve Industrial, and VuMetric reported these vulnerabilities to GE.
descriptions: value: GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. GE was made aware a “Last-key pressed” MODBUS register can be used to gain unauthorized information.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-200
description: CWE-200 Information Exposure
type: CWE
solutions: value: GE strongly recommends users with impacted firmware versions update their UR devices to UR firmware Version 8.10, or greater to resolve these vulnerabilities. GE provides additional mitigations and information about these vulnerabilities in GE Publication Number: GES-2021-004 (login required).
source: discovery: EXTERNAL
title: GE UR family exposure of sensitive information to an unauthorized actor
workarounds: value: GE recommends protecting UR IED by using network defense-in-depth practices. This includes, but is not limited to, placing UR IED inside the control system network security perimeter, and having access controls, monitoring (such as an Intrusion Detection System), and other mitigating technologies in place. 

GE recommends users refer to the UR Deployment guide for secure configuration of UR IED and system.
x_generator: engine: Vulnogram 0.0.9