PT-2022-4538 · General Electric · Inet Ii+4

Reid Wightman · Published 2022-03-31 · Updated 2025-04-12 · CVE-2022-24118

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions General Electric Renewable Energy iNET versions prior to 8.3.0 General Electric Renewable Energy iNET II versions prior to 8.3.0 General Electric Renewable Energy SD versions prior to 6.4.7 General Electric Renewable Energy TD220X versions prior to 2.0.16 General Electric Renewable Energy TD220MAX versions prior to 1.2.6

Description The issue is related to an uncontrolled resource consumption in the firmware of General Electric Renewable Energy industrial control equipment. Exploitation of this issue may allow an attacker to cause a denial of service. Certain General Electric Renewable Energy products are affected, allowing attackers to use a code to trigger a reboot into the factory default configuration.

Recommendations For iNET and iNET II versions prior to 8.3.0, update to version 8.3.0 or later. For SD versions prior to 6.4.7, update to version 6.4.7 or later. For TD220X versions prior to 2.0.16, update to version 2.0.16 or later. For TD220MAX versions prior to 1.2.6, update to version 1.2.6 or later.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2022-05408

CVE-2022-24118

Affected Products

Sd

Td220Max

Td220X

Inet

Inet Ii

References · 8

• https://safe-surf.ru/upload/VULN/VULN-20220405.13.pdf · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-090-06 · Patch
• https://bdu.fstec.ru/vul/2022-05408 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-24118 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24118 · Vendor Advisory
• https://t.me/cibsecurity/55324 · Telegram Post
• https://t.me/cvenotify/41315 · Telegram Post
• https://t.me/cvenotify/118962 · Telegram Post