CVE-2021-27430 — Vulnetix

CVE-2021-27430 PUBLISHED CVSS 8.399999618530273 HIGH

GE UR bootloader binary Version 7.00, 7.01 and 7.02 included unused hardcoded credentials. Additionally, a user with physical access to the UR IED can interrupt the boot sequence by rebooting the UR.

EPSS 0.05% · 15.2th percentile

Risk Scores

CVSS 3.1

8.399999618530273

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.05%

15.2th percentile

Affected Products

Vendor	Product	Versions
ge	ur_bootloader_binary	7.00, 7.01, 7.02
GE	UR bootloader binary	7.00, 7.01, 7.02

Exploit Intelligence

CIRCL seen: CVE-2021-27430 (circl-sighting)
https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02 (circl)
https://www.gegridsolutions.com/Passport/Login.aspx (circl)

Timeline

Mar 23, 2022 CVE Published
Mar 24, 2022 EPSS Score
May 14, 2022 EPSS Score
Jul 4, 2022 EPSS Score
Aug 25, 2022 EPSS Score
Oct 15, 2022 EPSS Score
Dec 5, 2022 EPSS Score
Jan 25, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Mar 17, 2023 EPSS Score
May 6, 2023 EPSS Score
Jun 26, 2023 EPSS Score

References

Open in Interactive Console →