Description
Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware. The firmware signature verification is enforced only on the client-side dedicated software Enervista UR Setup, allowing the integration check to be bypassed.
Scores
CVSS v3
6.1
EPSS
0.0001
EPSS Percentile
0.7%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-345
Status
published
Products (19)
GE Vernova/B30 Multilin
7.0 - 8.60
GE Vernova/B90 Multilin
7.0 - 8.60
GE Vernova/C30 Multilin
7.0 - 8.60
GE Vernova/C60 Multilin
7.0 - 8.60
GE Vernova/C70 Multilin
7.0 - 8.60
GE Vernova/C95 Multilin
7.0 - 8.60
GE Vernova/D30 Multilin
7.0 - 8.60
GE Vernova/D60 Multilin
7.0 - 8.60
GE Vernova/F35 Multilin
7.0 - 8.60
GE Vernova/F60 Multilin
7.0 - 8.60
... and 9 more
Published
Mar 10, 2025
Tracked Since
Feb 18, 2026