PT-2016-5113 · General Electric · Ge Multilink Ml810+6

Published 2016-06-09 · Updated 2021-03-29 · CVE-2016-2310

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions General Electric (GE) Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware prior to 5.5.0 General Electric (GE) Multilink ML810, ML3000, and ML3100 switches with firmware prior to 5.5.0k

Description The issue allows remote attackers to modify configuration settings via the web interface due to hardcoded credentials.

Recommendations For General Electric (GE) Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware prior to 5.5.0, update the firmware to version 5.5.0 or later. For General Electric (GE) Multilink ML810, ML3000, and ML3100 switches with firmware prior to 5.5.0k, update the firmware to version 5.5.0k or later.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2016-2310

Affected Products

Ge Multilink Ml1200

Ge Multilink Ml1600

Ge Multilink Ml2400

Ge Multilink Ml3000

Ge Multilink Ml3100

Ge Multilink Ml800

Ge Multilink Ml810

References · 3

• https://osv.dev/vulnerability/CVE-2016-2310 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2310 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-16-154-01 · Note