PT-2022-3900 · General Electric · Inet Ii+1

Published 2022-03-31 · Updated 2025-04-12 · CVE-2022-24120

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions General Electric Renewable Energy iNET versions prior to 8.3.0 General Electric Renewable Energy iNET II versions prior to 8.3.0

Description The issue is related to the storage of passwords in cleartext. This allows an attacker to view the contents of the configuration file and gain access to passwords. The problem affects certain General Electric Renewable Energy products, where cleartext credentials are stored in flash memory.

Recommendations For General Electric Renewable Energy iNET versions prior to 8.3.0, update to version 8.3.0 or later to resolve the issue. For General Electric Renewable Energy iNET II versions prior to 8.3.0, update to version 8.3.0 or later to resolve the issue.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

CWE-256

Related Identifiers

BDU:2022-04711

CVE-2022-24120

Affected Products

Inet

Inet Ii

References · 8

• https://safe-surf.ru/upload/VULN/VULN-20220405.13.pdf · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-090-06 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24120 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24120 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04711 · Security Note
• https://t.me/cvenotify/41312 · Telegram Post
• https://t.me/cibsecurity/55328 · Telegram Post
• https://t.me/cvenotify/118964 · Telegram Post