PT-2020-9408 · Ge · Ge Mark Vie Controller

Published 2020-04-07 · Updated 2020-04-08 · CVE-2019-13559

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: GE Mark VIe Controller (affected versions not specified)

Description: The GE Mark VIe Controller is shipped with pre-configured hard-coded credentials that may allow root-user access to the controller. A limited application of the affected product may ship without setup and configuration instructions immediately available to the end user. The bulk of controllers go into applications requiring the GE commissioning engineer to change default configurations during the installation process.

Recommendations: Reset controller passwords during installation in the operating environment. As a temporary workaround, consider changing the default configurations to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2019-13559

Affected Products

Ge Mark Vie Controller

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-13559 · Security Note
• https://t.me/cvenotify/2504 · Telegram Post
• https://us-cert.gov/ics/advisories/icsa-19-281-02 · Note