published June 30, 2017
⚠️ Weak cryptography in several GE Multilin relay products could expose user passwords like a poorly guarded treasure chest! 🔐 Think of it as a diner that keeps its recipe book out in the open — anyone can just walk by and find out how to make the secret sauce. Similarly, the non-random initialization vector used here makes it easy for attackers to crack the codes and access sensitive information. An attacker could easily perform a dictionary attack, retrieving user passwords from the front LCD panel or through Modbus commands. This means unauthorized access to the relays and potentially compromising vital protections. We’re talking about possible manipulation of crucial electrical systems, which could lead to serious operational mishaps!
Think of it as a diner that keeps its recipe book out in the open — anyone can just walk by and find out how to make the secret sauce. Similarly, the non-random initialization vector used here makes it easy for attackers to crack the codes and access sensitive information. This vulnerability arises from weak cryptography due to a non-random initialization vector used in creating ciphertexts for user passwords, making it susceptible to dictionary attacks. The vulnerable versions include various GE Multilin relay products and firmware instances prior to specific versions.
An attacker could easily perform a dictionary attack, retrieving user passwords from the front LCD panel or through Modbus commands. This means unauthorized access to the relays and potentially compromising vital protections. We’re talking about possible manipulation of crucial electrical systems, which could lead to serious operational mishaps! Upgrade to firmware version 7.47 or higher for the SR 750 and SR 760 relays, and ensure you're on versions 5.23 or higher for SR 469 and SR 745. For SR 489, ensure firmware is updated to 4.06 or later, and check the Multilin Universal Relay and URplus versions as well. Do this ASAP to tighten your security! You've got this! Following these steps will help secure your system and keep those pesky attackers at bay! 🛡️