PT-2025-10566 · Ge · Ge Vernova Enervista Ur Setup

Diego Giubertoni · Published 2025-03-10 · Updated 2025-03-15 · CVE-2025-27255

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions GE Vernova EnerVista UR Setup (affected versions not specified)

Description The issue concerns the use of hard-coded credentials in the software, allowing privilege escalation. An attacker can retrieve the hardcoded password by analyzing the application code, as the local user database is encrypted using this password.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2025-07186

CVE-2025-27255

Affected Products

Ge Vernova Enervista Ur Setup

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2025-27255 · Security Note
• https://bdu.fstec.ru/vul/2025-07186 · Security Note
• https://twitter.com/cracbot/status/1900502251187359861 · Twitter Post
• https://twitter.com/cracbot/status/1900864634523185168 · Twitter Post
• https://t.me/cvenotify/114425 · Telegram Post
• https://twitter.com/CVEnew/status/1899029538711236757 · Twitter Post
• https://t.me/cvetracker/18791 · Telegram Post
• https://vulners.com/cve/CVE-2025-27255 · Note
• https://t.me/latest_high_impact_cve/1942 · Telegram Post
• https://nozominetworks.com/labs/vulnerability-advisories-cve-2025-27255 · Note
• https://twitter.com/cracbot/status/1900139870347288879 · Twitter Post
• https://t.me/cvenotify/114036 · Telegram Post
• https://t.me/cvedetector/19946 · Telegram Post
• https://gevernova.com/grid-solutions/passport/login.aspx?ReturnUrl=%2fgrid-solutions%2fapp%2fDownloadFile.aspx%3fprod%3durfamily%26type%3d21%26file%3d76 · Note
• https://gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76 · Note