PT-2022-1906 · Ge · Ge Reason Rt431+2

Tom Westenberg · Published 2022-03-18 · Updated 2022-03-28 · CVE-2020-25197

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GE Reason RT430, RT431, and RT434 GNSS clocks versions prior to 08A06

Description The issue is related to a code injection vulnerability. This vulnerability could allow a remote attacker to execute arbitrary code on the system. The vulnerability exists in one of the webpages of the affected devices.

Recommendations For GE Reason RT430, RT431, and RT434 GNSS clocks versions prior to 08A06, update the firmware to version 08A06 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable webpage to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2022-01442

CVE-2020-25197

Affected Products

Ge Reason Rt430

Ge Reason Rt431

Ge Reason Rt434

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-25197 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25197 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01442 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-21-005-03 · Note
• https://gegridsolutions.com/app/DownloadFile.aspx?prod=RT430&type=21&file=5 · Note
• https://gegridsolutions.com/app/DownloadFile.aspx?prod=RT430&type=21&file=5 · Note