CVE-2021-27424CWE-200

GE UR family exposure of sensitive information to an unauthorized actor

Medium · published March 23, 2022

CVSS v3.1
5.3
EPSS
1%
Percentile
58.6
In the wild
Unconfirmed
What it is

GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. GE was made aware a “Last-key pressed” MODBUS register can be used to gain unauthorized information.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00878 · 58.6th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-03-23T19:46Z
EPSS history
Timeline
  • 23 MAR 19:46Z
    GE UR family exposure of sensitive information to an unauthorized actor
    cvelistv5