PT-2020-12985 · Ge Grid Solutions · Rt430+3

Ehab Hussein · Published 2020-06-02 · Updated 2020-06-08 · CVE-2020-12017

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GE Grid Solutions Reason RT Clocks versions prior to 08A05 GE Grid Solutions RT430 versions prior to 08A05 GE Grid Solutions RT431 versions prior to 08A05 GE Grid Solutions RT434 versions prior to 08A05

Description The device's web application contains a vulnerability that could allow multiple unauthenticated attacks, potentially causing serious impact. An unauthenticated attacker may execute arbitrary commands, send a request to a specific URL to make the device unresponsive, change the password of the configuration user account to modify the device's configuration via the web interface, and bypass authentication required to configure the device and reboot the system.

Recommendations For GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434 versions prior to 08A05, update the firmware to version 08A05 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation. Avoid using the web interface for configuration changes until the issue is resolved.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-12017

Affected Products

Rt430

Rt431

Rt434

Reason Rt Clocks

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-12017 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12017 · Vendor Advisory
• https://us-cert.gov/ics/advisories/icsa-20-154-05 · Note