PT-2025-10568 · Ge · Ge Vernova Ur Ied+1

Diego Giubertoni · Published 2025-03-10 · Updated 2025-03-12 · CVE-2025-27257

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions GE Vernova UR IED family devices (affected versions not specified)

Description The issue concerns an Insufficient Verification of Data Authenticity, which enables an authenticated user to install modified firmware. This is possible because firmware signature verification is only enforced on the client-side by the dedicated software Enervista UR Setup, allowing the integration check to be bypassed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

BDU:2025-07188

CVE-2025-27257

Affected Products

Enervista Ur Setup

Ge Vernova Ur Ied

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-27257 · Security Note
• https://bdu.fstec.ru/vul/2025-07188 · Security Note
• https://t.me/cvenotify/114427 · Telegram Post
• https://t.me/cvetracker/18793 · Telegram Post
• https://nozominetworks.com/labs/vulnerability-advisories-cve-2025-27257 · Note
• https://t.me/cvenotify/114038 · Telegram Post
• https://gevernova.com/grid-solutions/passport/login.aspx?ReturnUrl=%2fgrid-solutions%2fapp%2fDownloadFile.aspx%3fprod%3durfamily%26type%3d21%26file%3d76 · Note
• https://vulners.com/cve/CVE-2025-27257 · Note
• https://t.me/cvedetector/19948 · Telegram Post
• https://gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76 · Note
• https://twitter.com/CVEnew/status/1899029537033506958 · Twitter Post