Description
A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to bypass firewall rules or to send malicious traffic in the network.
References (2)
Core 2
Core References
Scores
CVSS v3
6.1
EPSS
0.0022
EPSS Percentile
12.3%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-15
Status
published
Products (19)
GE Vernova/B30 Multilin
7.0 - 8.60
GE Vernova/B90 Multilin
7.0 - 8.60
GE Vernova/C30 Multilin
7.0 - 8.60
GE Vernova/C60 Multilin
7.0 - 8.60
GE Vernova/C70 Multilin
7.0 - 8.60
GE Vernova/C95 Multilin
7.0 - 8.60
GE Vernova/D30 Multilin
7.0 - 8.60
GE Vernova/D60 Multilin
7.0 - 8.60
GE Vernova/F35 Multilin
7.0 - 8.60
GE Vernova/F60 Multilin
7.0 - 8.60
... and 9 more
Published
Mar 10, 2025
Tracked Since
Feb 18, 2026