CVE-2022-24118

Certain General Electric Renewable Energy products allow attackers to use a code to trigger a reboot into the factory default configuration

Critical · published December 26, 2022

CVSS v3.1
9.1
EPSS
1%
Percentile
50.2
In the wild
Unconfirmed
What it is

🚨 A simple code is all it takes to send certain GE Renewable Energy products back to factory settings! 🔥 Think of it like a reset button on a remote control that anyone can press, reverting everything to its original state — your carefully tailored configurations vanish as quickly as a puff of smoke! An attacker could trigger a reboot into factory default, erasing all your custom settings and potentially disrupting energy management systems. This could lead to operational chaos, affecting everything from efficiency to safety. The stakes couldn't be higher!

Put simply

Think of it like a reset button on a remote control that anyone can press, reverting everything to its original state — your carefully tailored configurations vanish as quickly as a puff of smoke! This vulnerability allows unauthorized users to execute a code that triggers a reboot into the factory default configuration for specific GE Renewable Energy products, including iNET and TD220 models, prior to their respective patched versions.

What to do

An attacker could trigger a reboot into factory default, erasing all your custom settings and potentially disrupting energy management systems. This could lead to operational chaos, affecting everything from efficiency to safety. The stakes couldn't be higher! Ensure you upgrade to the latest versions: iNET and iNET II to 8.3.0, SD to 6.4.7, TD220X to 2.0.16, and TD220MAX to 1.2.6. Regularly review your systems for any potential vulnerabilities like this one. 🛡️ You've got this! Stay proactive, and together we can make the internet a safer place! 🦸

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00643 · 50.2th percentile
Published
2022-12-26T00:00Z
EPSS history
Timeline
  • 26 DEC 00:00Z
    Certain General Electric Renewable Energy products allow attackers to use a code to trigger a reboot into the factory default configuration
    cvelistv5