CVE-2025-27253CWE-15

A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide…

Medium · published March 10, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
13.4
In the wild
Unconfirmed
What it is

A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to bypass firewall rules or to send malicious traffic in the network.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00234 · 13.4th percentile
Weakness
CWE-15 · External Control of System or Configuration Setting
Published
2025-03-10T09:04Z
EPSS history
Timeline
  • 10 MAR 09:04Z
    A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide…
    cvelistv5