PT-2022-3898 · General Electric · Inet Ii+1

Reid Wightman · Published 2022-03-31 · Updated 2025-04-12 · CVE-2022-24119

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions General Electric Renewable Energy iNET versions prior to 8.3.0 General Electric Renewable Energy iNET II versions prior to 8.3.0

Description The issue is related to the presence of undocumented configuration commands in the software of General Electric Renewable Energy's iNET and iNET II products. This allows a remote attacker to gain full access to the application and compromise the target system. The vulnerability is associated with a hidden feature for unauthenticated remote access to the device configuration shell.

Recommendations For General Electric Renewable Energy iNET versions prior to 8.3.0, update to version 8.3.0 or later to resolve the issue. For General Electric Renewable Energy iNET II versions prior to 8.3.0, update to version 8.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the device configuration shell until a patch is available.

Fix

Hidden Functionality

Weakness Enumeration

CWE-912

CWE-829

Related Identifiers

BDU:2022-04709

CVE-2022-24119

Affected Products

Inet

Inet Ii

References · 8

• https://safe-surf.ru/upload/VULN/VULN-20220405.13.pdf · Security Note
• https://bdu.fstec.ru/vul/2022-04709 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-090-06 · Patch
• https://osv.dev/vulnerability/CVE-2022-24119 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24119 · Security Note
• https://t.me/cvenotify/118963 · Telegram Post
• https://t.me/cibsecurity/55323 · Telegram Post
• https://t.me/cvenotify/41313 · Telegram Post