PT-2022-9818 · Ge · Ge Ur Bootloader

Published 2022-03-23 · Updated 2022-03-31 · CVE-2021-27430

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GE UR bootloader binary versions 7.00 through 7.02

Description The issue concerns unused hardcoded credentials in the bootloader binary. A user with physical access to the UR IED can interrupt the boot sequence by rebooting the UR.

Recommendations For versions 7.00 through 7.02, consider restricting physical access to the UR IED to minimize the risk of exploitation. As a temporary workaround, consider implementing additional security measures to prevent unauthorized rebooting of the UR IED until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2021-27430

Affected Products

Ge Ur Bootloader

References · 5

• https://osv.dev/vulnerability/CVE-2021-27430 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27430 · Security Note
• https://gegridsolutions.com/Passport/Login.aspx · Vendor Advisory
• https://t.me/cvenotify/28225 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-21-075-02 · Note