Search
Find a vulnerability
Search criteria
6 vulnerabilities found for rt430_firmware by ge
CVE-2020-25197 (GCVE-0-2020-25197)
Vulnerability from nvd – Published: 2022-03-18 18:00 – Updated: 2025-04-16 16:41
VLAI
Title
GE Reason RT43X Clocks Code Injection
Summary
A code injection vulnerability exists in one of the webpages in GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06 that could allow an authenticated remote attacker to execute arbitrary code on the system.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsa-2… | x_refsource_CONFIRM |
| https://www.gegridsolutions.com/app/DownloadFile.… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| GE | Reason RT43X Clocks |
Affected:
unspecified , < 08A06
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:33:05.272Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430\u0026type=21\u0026file=5"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2020-25197",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T15:57:49.847925Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T16:41:36.185Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Reason RT43X Clocks",
"vendor": "GE",
"versions": [
{
"lessThan": "08A06",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Tom Westenberg of Thales UK reported these vulnerabilities to GE."
}
],
"descriptions": [
{
"lang": "en",
"value": "A code injection vulnerability exists in one of the webpages in GE Reason RT430, RT431 \u0026 RT434 GNSS clocks in firmware versions prior to version 08A06 that could allow an authenticated remote attacker to execute arbitrary code on the system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-18T18:00:34.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430\u0026type=21\u0026file=5"
}
],
"solutions": [
{
"lang": "en",
"value": "GE strongly recommends users of Reason RT43X products update their units to firmware Version 08A06 or greater to resolve these issues. The firmware update addresses both vulnerabilities as described in the Reason RT43X 08A06 Release Notes.\n\nPlease see GE publication GES-2020-006 (login required) for more details on these issues."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "GE Reason RT43X Clocks Code Injection",
"workarounds": [
{
"lang": "en",
"value": "GE recommends users evaluate current risk and implement appropriate network security mitigation measures as follows. The following mitigation actions do not ensure complete security but should be considered until the affected time synchronization product is upgraded:\n Use strong network and physical security protection to prevent an attacker from reaching the local network where Reason RT43X clocks are normally installed. \n Block TCP/IP Ports 80 and 443 to block the HTTP/HTTPS access to web interface with Reason RT43X products, avoiding all the vulnerabilities. This TCP/IP port blocking should be limited to the Ethernet port interface where the Reason RT43X clock is connected (e.g., using Access Control List (ACL)). Otherwise, other HTTP/HTTPS applications may be affected.\n Minimize network exposure for all control system devices and/or systems and ensure they are not accessible from the Internet.\n Analyze security events to early detect unexpected traffic/communication."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2020-25197",
"STATE": "PUBLIC",
"TITLE": "GE Reason RT43X Clocks Code Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Reason RT43X Clocks",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "08A06"
}
]
}
}
]
},
"vendor_name": "GE"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Tom Westenberg of Thales UK reported these vulnerabilities to GE."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A code injection vulnerability exists in one of the webpages in GE Reason RT430, RT431 \u0026 RT434 GNSS clocks in firmware versions prior to version 08A06 that could allow an authenticated remote attacker to execute arbitrary code on the system."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03",
"refsource": "CONFIRM",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03"
},
{
"name": "https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430\u0026type=21\u0026file=5",
"refsource": "CONFIRM",
"url": "https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430\u0026type=21\u0026file=5"
}
]
},
"solution": [
{
"lang": "en",
"value": "GE strongly recommends users of Reason RT43X products update their units to firmware Version 08A06 or greater to resolve these issues. The firmware update addresses both vulnerabilities as described in the Reason RT43X 08A06 Release Notes.\n\nPlease see GE publication GES-2020-006 (login required) for more details on these issues."
}
],
"source": {
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "GE recommends users evaluate current risk and implement appropriate network security mitigation measures as follows. The following mitigation actions do not ensure complete security but should be considered until the affected time synchronization product is upgraded:\n Use strong network and physical security protection to prevent an attacker from reaching the local network where Reason RT43X clocks are normally installed. \n Block TCP/IP Ports 80 and 443 to block the HTTP/HTTPS access to web interface with Reason RT43X products, avoiding all the vulnerabilities. This TCP/IP port blocking should be limited to the Ethernet port interface where the Reason RT43X clock is connected (e.g., using Access Control List (ACL)). Otherwise, other HTTP/HTTPS applications may be affected.\n Minimize network exposure for all control system devices and/or systems and ensure they are not accessible from the Internet.\n Analyze security events to early detect unexpected traffic/communication."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2020-25197",
"datePublished": "2022-03-18T18:00:34.000Z",
"dateReserved": "2020-09-04T00:00:00.000Z",
"dateUpdated": "2025-04-16T16:41:36.185Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25193 (GCVE-0-2020-25193)
Vulnerability from nvd – Published: 2022-03-18 18:00 – Updated: 2025-04-16 16:41
VLAI
Title
GE Reason RT43X Clocks Use of Hard-coded Cryptographic Key
Summary
By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06, attackers would be able to intercept and decrypt encrypted traffic through an HTTPS connection.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsa-2… | x_refsource_CONFIRM |
| https://www.gegridsolutions.com/app/DownloadFile.… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| GE | Reason RT43X Clocks |
Affected:
unspecified , < 08A06
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:26:10.063Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430\u0026type=21\u0026file=5"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2020-25193",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T15:59:19.792538Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T16:41:25.123Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Reason RT43X Clocks",
"vendor": "GE",
"versions": [
{
"lessThan": "08A06",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Tom Westenberg of Thales UK reported these vulnerabilities to GE."
}
],
"descriptions": [
{
"lang": "en",
"value": "By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 \u0026 RT434 GNSS clocks in firmware versions prior to version 08A06, attackers would be able to intercept and decrypt encrypted traffic through an HTTPS connection."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321 Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-18T18:00:35.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430\u0026type=21\u0026file=5"
}
],
"solutions": [
{
"lang": "en",
"value": "GE strongly recommends users of Reason RT43X products update their units to firmware Version 08A06 or greater to resolve these issues. The firmware update addresses both vulnerabilities as described in the Reason RT43X 08A06 Release Notes.\n\nPlease see GE publication GES-2020-006 (login required) for more details on these issues."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "GE Reason RT43X Clocks Use of Hard-coded Cryptographic Key",
"workarounds": [
{
"lang": "en",
"value": "GE recommends users evaluate current risk and implement appropriate network security mitigation measures as follows. The following mitigation actions do not ensure complete security but should be considered until the affected time synchronization product is upgraded:\n Use strong network and physical security protection to prevent an attacker from reaching the local network where Reason RT43X clocks are normally installed. \n Block TCP/IP Ports 80 and 443 to block the HTTP/HTTPS access to web interface with Reason RT43X products, avoiding all the vulnerabilities. This TCP/IP port blocking should be limited to the Ethernet port interface where the Reason RT43X clock is connected (e.g., using Access Control List (ACL)). Otherwise, other HTTP/HTTPS applications may be affected.\n Minimize network exposure for all control system devices and/or systems and ensure they are not accessible from the Internet.\n Analyze security events to early detect unexpected traffic/communication."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2020-25193",
"STATE": "PUBLIC",
"TITLE": "GE Reason RT43X Clocks Use of Hard-coded Cryptographic Key"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Reason RT43X Clocks",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "08A06"
}
]
}
}
]
},
"vendor_name": "GE"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Tom Westenberg of Thales UK reported these vulnerabilities to GE."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 \u0026 RT434 GNSS clocks in firmware versions prior to version 08A06, attackers would be able to intercept and decrypt encrypted traffic through an HTTPS connection."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-321 Use of Hard-coded Cryptographic Key"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03",
"refsource": "CONFIRM",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03"
},
{
"name": "https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430\u0026type=21\u0026file=5",
"refsource": "CONFIRM",
"url": "https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430\u0026type=21\u0026file=5"
}
]
},
"solution": [
{
"lang": "en",
"value": "GE strongly recommends users of Reason RT43X products update their units to firmware Version 08A06 or greater to resolve these issues. The firmware update addresses both vulnerabilities as described in the Reason RT43X 08A06 Release Notes.\n\nPlease see GE publication GES-2020-006 (login required) for more details on these issues."
}
],
"source": {
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "GE recommends users evaluate current risk and implement appropriate network security mitigation measures as follows. The following mitigation actions do not ensure complete security but should be considered until the affected time synchronization product is upgraded:\n Use strong network and physical security protection to prevent an attacker from reaching the local network where Reason RT43X clocks are normally installed. \n Block TCP/IP Ports 80 and 443 to block the HTTP/HTTPS access to web interface with Reason RT43X products, avoiding all the vulnerabilities. This TCP/IP port blocking should be limited to the Ethernet port interface where the Reason RT43X clock is connected (e.g., using Access Control List (ACL)). Otherwise, other HTTP/HTTPS applications may be affected.\n Minimize network exposure for all control system devices and/or systems and ensure they are not accessible from the Internet.\n Analyze security events to early detect unexpected traffic/communication."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2020-25193",
"datePublished": "2022-03-18T18:00:35.000Z",
"dateReserved": "2020-09-04T00:00:00.000Z",
"dateUpdated": "2025-04-16T16:41:25.123Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-12017 (GCVE-0-2020-12017)
Vulnerability from nvd – Published: 2020-06-02 18:31 – Updated: 2024-08-04 11:48
VLAI
Summary
GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute arbitrary commands and send a request to a specific URL that could cause the device to become unresponsive. The unauthenticated attacker may change the password of the 'configuration' user account, allowing the attacker to modify the configuration of the device via the web interface using the new password. This vulnerability may also allow an unauthenticated attacker to bypass the authentication required to configure the device and reboot the system.
Severity
No CVSS data available.
CWE
- CWE-306 - MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.us-cert.gov/ics/advisories/icsa-20-154-05 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | GE Grid Solutions Reason RT Clocks |
Affected:
RT430, RT431, and RT434, all firmware versions prior to 08A05
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:48:58.016Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-154-05"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "GE Grid Solutions Reason RT Clocks",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "RT430, RT431, and RT434, all firmware versions prior to 08A05"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device\u2019s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute arbitrary commands and send a request to a specific URL that could cause the device to become unresponsive. The unauthenticated attacker may change the password of the \u0027configuration\u0027 user account, allowing the attacker to modify the configuration of the device via the web interface using the new password. This vulnerability may also allow an unauthenticated attacker to bypass the authentication required to configure the device and reboot the system."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-02T18:31:05.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-154-05"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2020-12017",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "GE Grid Solutions Reason RT Clocks",
"version": {
"version_data": [
{
"version_value": "RT430, RT431, and RT434, all firmware versions prior to 08A05"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device\u2019s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute arbitrary commands and send a request to a specific URL that could cause the device to become unresponsive. The unauthenticated attacker may change the password of the \u0027configuration\u0027 user account, allowing the attacker to modify the configuration of the device via the web interface using the new password. This vulnerability may also allow an unauthenticated attacker to bypass the authentication required to configure the device and reboot the system."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.us-cert.gov/ics/advisories/icsa-20-154-05",
"refsource": "MISC",
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-154-05"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2020-12017",
"datePublished": "2020-06-02T18:31:05.000Z",
"dateReserved": "2020-04-21T00:00:00.000Z",
"dateUpdated": "2024-08-04T11:48:58.016Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25193 (GCVE-0-2020-25193)
Vulnerability from cvelistv5 – Published: 2022-03-18 18:00 – Updated: 2025-04-16 16:41
VLAI
Title
GE Reason RT43X Clocks Use of Hard-coded Cryptographic Key
Summary
By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06, attackers would be able to intercept and decrypt encrypted traffic through an HTTPS connection.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsa-2… | x_refsource_CONFIRM |
| https://www.gegridsolutions.com/app/DownloadFile.… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| GE | Reason RT43X Clocks |
Affected:
unspecified , < 08A06
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:26:10.063Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430\u0026type=21\u0026file=5"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2020-25193",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T15:59:19.792538Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T16:41:25.123Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Reason RT43X Clocks",
"vendor": "GE",
"versions": [
{
"lessThan": "08A06",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Tom Westenberg of Thales UK reported these vulnerabilities to GE."
}
],
"descriptions": [
{
"lang": "en",
"value": "By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 \u0026 RT434 GNSS clocks in firmware versions prior to version 08A06, attackers would be able to intercept and decrypt encrypted traffic through an HTTPS connection."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321 Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-18T18:00:35.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430\u0026type=21\u0026file=5"
}
],
"solutions": [
{
"lang": "en",
"value": "GE strongly recommends users of Reason RT43X products update their units to firmware Version 08A06 or greater to resolve these issues. The firmware update addresses both vulnerabilities as described in the Reason RT43X 08A06 Release Notes.\n\nPlease see GE publication GES-2020-006 (login required) for more details on these issues."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "GE Reason RT43X Clocks Use of Hard-coded Cryptographic Key",
"workarounds": [
{
"lang": "en",
"value": "GE recommends users evaluate current risk and implement appropriate network security mitigation measures as follows. The following mitigation actions do not ensure complete security but should be considered until the affected time synchronization product is upgraded:\n Use strong network and physical security protection to prevent an attacker from reaching the local network where Reason RT43X clocks are normally installed. \n Block TCP/IP Ports 80 and 443 to block the HTTP/HTTPS access to web interface with Reason RT43X products, avoiding all the vulnerabilities. This TCP/IP port blocking should be limited to the Ethernet port interface where the Reason RT43X clock is connected (e.g., using Access Control List (ACL)). Otherwise, other HTTP/HTTPS applications may be affected.\n Minimize network exposure for all control system devices and/or systems and ensure they are not accessible from the Internet.\n Analyze security events to early detect unexpected traffic/communication."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2020-25193",
"STATE": "PUBLIC",
"TITLE": "GE Reason RT43X Clocks Use of Hard-coded Cryptographic Key"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Reason RT43X Clocks",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "08A06"
}
]
}
}
]
},
"vendor_name": "GE"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Tom Westenberg of Thales UK reported these vulnerabilities to GE."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 \u0026 RT434 GNSS clocks in firmware versions prior to version 08A06, attackers would be able to intercept and decrypt encrypted traffic through an HTTPS connection."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-321 Use of Hard-coded Cryptographic Key"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03",
"refsource": "CONFIRM",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03"
},
{
"name": "https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430\u0026type=21\u0026file=5",
"refsource": "CONFIRM",
"url": "https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430\u0026type=21\u0026file=5"
}
]
},
"solution": [
{
"lang": "en",
"value": "GE strongly recommends users of Reason RT43X products update their units to firmware Version 08A06 or greater to resolve these issues. The firmware update addresses both vulnerabilities as described in the Reason RT43X 08A06 Release Notes.\n\nPlease see GE publication GES-2020-006 (login required) for more details on these issues."
}
],
"source": {
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "GE recommends users evaluate current risk and implement appropriate network security mitigation measures as follows. The following mitigation actions do not ensure complete security but should be considered until the affected time synchronization product is upgraded:\n Use strong network and physical security protection to prevent an attacker from reaching the local network where Reason RT43X clocks are normally installed. \n Block TCP/IP Ports 80 and 443 to block the HTTP/HTTPS access to web interface with Reason RT43X products, avoiding all the vulnerabilities. This TCP/IP port blocking should be limited to the Ethernet port interface where the Reason RT43X clock is connected (e.g., using Access Control List (ACL)). Otherwise, other HTTP/HTTPS applications may be affected.\n Minimize network exposure for all control system devices and/or systems and ensure they are not accessible from the Internet.\n Analyze security events to early detect unexpected traffic/communication."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2020-25193",
"datePublished": "2022-03-18T18:00:35.000Z",
"dateReserved": "2020-09-04T00:00:00.000Z",
"dateUpdated": "2025-04-16T16:41:25.123Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25197 (GCVE-0-2020-25197)
Vulnerability from cvelistv5 – Published: 2022-03-18 18:00 – Updated: 2025-04-16 16:41
VLAI
Title
GE Reason RT43X Clocks Code Injection
Summary
A code injection vulnerability exists in one of the webpages in GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06 that could allow an authenticated remote attacker to execute arbitrary code on the system.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsa-2… | x_refsource_CONFIRM |
| https://www.gegridsolutions.com/app/DownloadFile.… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| GE | Reason RT43X Clocks |
Affected:
unspecified , < 08A06
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:33:05.272Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430\u0026type=21\u0026file=5"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2020-25197",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T15:57:49.847925Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T16:41:36.185Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Reason RT43X Clocks",
"vendor": "GE",
"versions": [
{
"lessThan": "08A06",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Tom Westenberg of Thales UK reported these vulnerabilities to GE."
}
],
"descriptions": [
{
"lang": "en",
"value": "A code injection vulnerability exists in one of the webpages in GE Reason RT430, RT431 \u0026 RT434 GNSS clocks in firmware versions prior to version 08A06 that could allow an authenticated remote attacker to execute arbitrary code on the system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-18T18:00:34.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430\u0026type=21\u0026file=5"
}
],
"solutions": [
{
"lang": "en",
"value": "GE strongly recommends users of Reason RT43X products update their units to firmware Version 08A06 or greater to resolve these issues. The firmware update addresses both vulnerabilities as described in the Reason RT43X 08A06 Release Notes.\n\nPlease see GE publication GES-2020-006 (login required) for more details on these issues."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "GE Reason RT43X Clocks Code Injection",
"workarounds": [
{
"lang": "en",
"value": "GE recommends users evaluate current risk and implement appropriate network security mitigation measures as follows. The following mitigation actions do not ensure complete security but should be considered until the affected time synchronization product is upgraded:\n Use strong network and physical security protection to prevent an attacker from reaching the local network where Reason RT43X clocks are normally installed. \n Block TCP/IP Ports 80 and 443 to block the HTTP/HTTPS access to web interface with Reason RT43X products, avoiding all the vulnerabilities. This TCP/IP port blocking should be limited to the Ethernet port interface where the Reason RT43X clock is connected (e.g., using Access Control List (ACL)). Otherwise, other HTTP/HTTPS applications may be affected.\n Minimize network exposure for all control system devices and/or systems and ensure they are not accessible from the Internet.\n Analyze security events to early detect unexpected traffic/communication."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2020-25197",
"STATE": "PUBLIC",
"TITLE": "GE Reason RT43X Clocks Code Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Reason RT43X Clocks",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "08A06"
}
]
}
}
]
},
"vendor_name": "GE"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Tom Westenberg of Thales UK reported these vulnerabilities to GE."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A code injection vulnerability exists in one of the webpages in GE Reason RT430, RT431 \u0026 RT434 GNSS clocks in firmware versions prior to version 08A06 that could allow an authenticated remote attacker to execute arbitrary code on the system."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03",
"refsource": "CONFIRM",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03"
},
{
"name": "https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430\u0026type=21\u0026file=5",
"refsource": "CONFIRM",
"url": "https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430\u0026type=21\u0026file=5"
}
]
},
"solution": [
{
"lang": "en",
"value": "GE strongly recommends users of Reason RT43X products update their units to firmware Version 08A06 or greater to resolve these issues. The firmware update addresses both vulnerabilities as described in the Reason RT43X 08A06 Release Notes.\n\nPlease see GE publication GES-2020-006 (login required) for more details on these issues."
}
],
"source": {
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "GE recommends users evaluate current risk and implement appropriate network security mitigation measures as follows. The following mitigation actions do not ensure complete security but should be considered until the affected time synchronization product is upgraded:\n Use strong network and physical security protection to prevent an attacker from reaching the local network where Reason RT43X clocks are normally installed. \n Block TCP/IP Ports 80 and 443 to block the HTTP/HTTPS access to web interface with Reason RT43X products, avoiding all the vulnerabilities. This TCP/IP port blocking should be limited to the Ethernet port interface where the Reason RT43X clock is connected (e.g., using Access Control List (ACL)). Otherwise, other HTTP/HTTPS applications may be affected.\n Minimize network exposure for all control system devices and/or systems and ensure they are not accessible from the Internet.\n Analyze security events to early detect unexpected traffic/communication."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2020-25197",
"datePublished": "2022-03-18T18:00:34.000Z",
"dateReserved": "2020-09-04T00:00:00.000Z",
"dateUpdated": "2025-04-16T16:41:36.185Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-12017 (GCVE-0-2020-12017)
Vulnerability from cvelistv5 – Published: 2020-06-02 18:31 – Updated: 2024-08-04 11:48
VLAI
Summary
GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute arbitrary commands and send a request to a specific URL that could cause the device to become unresponsive. The unauthenticated attacker may change the password of the 'configuration' user account, allowing the attacker to modify the configuration of the device via the web interface using the new password. This vulnerability may also allow an unauthenticated attacker to bypass the authentication required to configure the device and reboot the system.
Severity
No CVSS data available.
CWE
- CWE-306 - MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.us-cert.gov/ics/advisories/icsa-20-154-05 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | GE Grid Solutions Reason RT Clocks |
Affected:
RT430, RT431, and RT434, all firmware versions prior to 08A05
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:48:58.016Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-154-05"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "GE Grid Solutions Reason RT Clocks",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "RT430, RT431, and RT434, all firmware versions prior to 08A05"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device\u2019s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute arbitrary commands and send a request to a specific URL that could cause the device to become unresponsive. The unauthenticated attacker may change the password of the \u0027configuration\u0027 user account, allowing the attacker to modify the configuration of the device via the web interface using the new password. This vulnerability may also allow an unauthenticated attacker to bypass the authentication required to configure the device and reboot the system."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-02T18:31:05.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-154-05"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2020-12017",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "GE Grid Solutions Reason RT Clocks",
"version": {
"version_data": [
{
"version_value": "RT430, RT431, and RT434, all firmware versions prior to 08A05"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device\u2019s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute arbitrary commands and send a request to a specific URL that could cause the device to become unresponsive. The unauthenticated attacker may change the password of the \u0027configuration\u0027 user account, allowing the attacker to modify the configuration of the device via the web interface using the new password. This vulnerability may also allow an unauthenticated attacker to bypass the authentication required to configure the device and reboot the system."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.us-cert.gov/ics/advisories/icsa-20-154-05",
"refsource": "MISC",
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-154-05"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2020-12017",
"datePublished": "2020-06-02T18:31:05.000Z",
"dateReserved": "2020-04-21T00:00:00.000Z",
"dateUpdated": "2024-08-04T11:48:58.016Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}