PT-2022-9811 · Ge · Ge Ur Firmware

Published 2022-03-23 · Updated 2022-04-01 · CVE-2021-27418

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GE UR firmware versions prior to 8.1x

Description The issue concerns the web interface of the GE UR firmware, which has read-only access but fails to properly validate user input. This failure makes it possible to perform cross-site scripting attacks, allowing malicious scripts to be sent. Additionally, the UR Firmware web server does not perform HTML encoding of user-supplied strings, further exacerbating the issue.

Recommendations For GE UR firmware versions prior to 8.1x, update to version 8.1x or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation. Avoid using the web interface until the issue is resolved.

Fix

XSS

RCE

Weakness Enumeration

CWE-79

CWE-20

Related Identifiers

CVE-2021-27418

Affected Products

Ge Ur Firmware

References · 5

• https://osv.dev/vulnerability/CVE-2021-27418 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27418 · Security Note
• https://gegridsolutions.com/Passport/Login.aspx · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-21-075-02 · Note
• https://t.me/cvenotify/28294 · Telegram Post