PT-2023-14419 · Ge Grid Solutions · Ge Grid Solutions Ms3000

Daniel Szameitat · Publicado 2023-01-17 · Atualizado 2023-01-26 · CVE-2022-43977

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GE Grid Solutions MS3000 versions prior to 3.7.6.25p0 3.2.2.17p0 4.7p0

Description An issue was discovered where the debug port accessible via TCP, utilizing a qconn service, lacks access control. This issue affects GE Grid Solutions MS3000 devices.

Recommendations For versions prior to 3.7.6.25p0 3.2.2.17p0 4.7p0, consider disabling the qconn service or restricting access to the debug port via TCP as a temporary workaround until a patch is available.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2022-43977

Produtos afetados

Ge Grid Solutions Ms3000

Referências · 5

• https://osv.dev/vulnerability/CVE-2022-43977 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-43977 · Nota de Segurança
• https://t.me/cibsecurity/56630 · Publicação no Telegram
• https://wid.cert-bund.de/.well-known/csaf/white/2022/bsi-2022-0005.json · Nota
• https://t.me/cvenotify/42880 · Publicação no Telegram