PT-2022-3901 · General Electric · Inet Ii+4

Reid Wightman · Published 2022-03-31 · Updated 2025-04-12 · CVE-2022-24117

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions General Electric Renewable Energy iNET versions prior to 8.3.0 General Electric Renewable Energy iNET II versions prior to 8.3.0 General Electric Renewable Energy SD versions prior to 6.4.7 General Electric Renewable Energy TD220X versions prior to 2.0.16 General Electric Renewable Energy TD220MAX versions prior to 1.2.6

Description The issue is related to the download of firmware without an integrity check in certain General Electric Renewable Energy products. This could allow a remote attacker to gain unauthorized access to the target system.

Recommendations For iNET versions prior to 8.3.0, update to version 8.3.0 or later. For iNET II versions prior to 8.3.0, update to version 8.3.0 or later. For SD versions prior to 6.4.7, update to version 6.4.7 or later. For TD220X versions prior to 2.0.16, update to version 2.0.16 or later. For TD220MAX versions prior to 1.2.6, update to version 1.2.6 or later.

Fix

Weakness Enumeration

CWE-494

Related Identifiers

BDU:2022-04712

CVE-2022-24117

Affected Products

Sd

Td220Max

Td220X

Inet

Inet Ii

References · 7

• https://safe-surf.ru/upload/VULN/VULN-20220405.13.pdf · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-24117 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-090-06 · Patch
• https://bdu.fstec.ru/vul/2022-04712 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24117 · Vendor Advisory
• https://t.me/cvenotify/118961 · Telegram Post
• https://t.me/cibsecurity/55342 · Telegram Post