CVE-2021-31477

HIGH

GE Reason RPV311 Firmware 14A03 - Unauthenticated Remote Code Execution via Hard-coded Credentials

Title source: llm
STIX 2.1

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware and filesystem of the device. The firmware and filesystem contain hard-coded default credentials. An attacker can leverage this vulnerability to execute code in the context of the download user. Was ZDI-CAN-11852.

References (2)

Core 2

Scores

CVSS v3 7.3
EPSS 0.0264
EPSS Percentile 83.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Details

CWE
CWE-798
Status published
Products (1)
ge/reason_rpv311_firmware 14a03
Published Jun 16, 2021
Tracked Since Feb 18, 2026