GE Vernova Vulnerabilities and Affected Products

Open in search

Explore source-attributed vulnerabilities associated with GE Vernova products.

Products

Showing 11 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

Enervista UR Setup DLL Hijacking

Vulnerability in GE Vernova Enervista UR Setup on Windows.This issue affects Enervista: 8.6 and previous versions.

CWE-35Feb 10, 2026
CVSS4.6v3.1EPSS0.199%PoCs0SignalsSTIX

Enervista UR Setup Directory Traversal Vulnerability

A vulnerability in GE Vernova Enervista UR Setup on Windows allows File Manipulation.This issue affects Enervista: 8.6 and prior versions.

CWE-23Feb 10, 2026
CVSS2.9v3.1EPSS0.229%PoCs0SignalsSTIX

Smallworld SWMFS Improper Authentication

Improper Authentication vulnerability in GE Vernova Smallworld on Windows, Linux allows Authentication Abuse.This issue affects Smallworld: 5.3.3 and prior versions for Linux, and 5.3.4. and prior versions for Windows.

CWE-287Nov 7, 2025
CVSS9.3v4.0EPSS0.499%PoCs0SignalsSTIX

Smallworld SWMFS Arbitrary File Ops

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in GE Vernova Smallworld on Windows, Linux allows File Manipulation.This issue affects Smallworld: 5.3.5. and previous versions.

CWE-22Nov 7, 2025
CVSS5.3v4.0EPSS0.347%PoCs0SignalsSTIX

S1 Agile Privilege Escalation

Improper Privilege Management vulnerability in GE Vernova S1 Agile Configuration Software on Windows allows Privilege Escalation.This issue affects S1 Agile Configuration Software: 3.1 and previous version.

CWE-269Sep 22, 2025
CVSS7.5v4.0EPSS0.111%PoCs0SignalsSTIX

WorkstationST EGD Configuration Server Path Traversal Vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in GE Vernova WorkstationST on Windows (EGD Configuration Server modules) allows Path Traversal.This issue affects WorkstationST: WorkstationST V07.10.10C and earlier.

CWE-22May 19, 2025
CVSS5.9v3.1EPSS0.234%PoCs0SignalsSTIX

Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware. The firmware signature verification is enforced only on the client-side dedicated software Enervista UR Setup, allowing the integration check to be bypassed.

CWE-345Mar 10, 2025
CVSS6.1v3.1EPSS0.178%PoCs0SignalsSTIX

Missing Authentication for Critical Function vulnerability in GE Vernova Enervista UR Setup application allows Authentication Bypass due to a missing SSH server authentication. Since the client connection is not authenticated, an attacker may perform a man-in-the-middle attack on the network.

CWE-306Mar 10, 2025
CVSS8.3v3.1EPSS0.277%PoCs0SignalsSTIX

Use of Hard-coded Credentials vulnerability in GE Vernova EnerVista UR Setup allows Privilege Escalation. The local user database is encrypted using an hardcoded password retrievable by an attacker analyzing the application code.

CWE-798Mar 10, 2025
CVSS8.0v3.1EPSS0.149%PoCs0SignalsSTIX

CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass.  The software's startup authentication can be disabled by altering a Windows registry setting that any user can modify.

CWE-282CWE-287Mar 10, 2025
CVSS8.0v3.1EPSS0.184%PoCs0SignalsSTIX

A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to bypass firewall rules or to send malicious traffic in the network.

CWE-15CWE-20Mar 10, 2025
CVSS6.1v3.1EPSS0.229%PoCs0SignalsSTIX