Ge vulnerabilities
127 vulnerabilities
Known vulnerabilities in Ge products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 143 products.
Products
50 of 143- Cimplicity10 vulnerabilities
- Intelligent Platforms Proficy Hmi\/Scada Cimplicity10 vulnerabilities
- Industrial Gateway Server7 vulnerabilities
- Ge Communicator6 vulnerabilities
- Intelligent Platforms Proficy Historian6 vulnerabilities
- Intelligent Platforms Proficy Process Systems With Cimplicity6 vulnerabilities
- Intelligent Platforms Proficy Real Time Information Portal6 vulnerabilities
- Multilin B306 vulnerabilities
- Multilin B906 vulnerabilities
- Multilin C306 vulnerabilities
- Multilin C606 vulnerabilities
- Multilin C706 vulnerabilities
- Multilin C956 vulnerabilities
- Multilin D306 vulnerabilities
- Multilin D606 vulnerabilities
- Multilin F356 vulnerabilities
- Multilin F606 vulnerabilities
- Multilin G306 vulnerabilities
- Multilin G606 vulnerabilities
- Multilin L306 vulnerabilities
- Multilin L606 vulnerabilities
- Multilin L906 vulnerabilities
- Multilin M606 vulnerabilities
- Multilin N606 vulnerabilities
- Multilin T356 vulnerabilities
- Multilin T606 vulnerabilities
- UR Family6 vulnerabilities
- Ifix5 vulnerabilities
- Inet 9005 vulnerabilities
- Inet Ii 9005 vulnerabilities
- Mds Pulsenet5 vulnerabilities
- Proficy Historian5 vulnerabilities
- Sd15 vulnerabilities
- Sd25 vulnerabilities
- Sd45 vulnerabilities
- Sd95 vulnerabilities
- Td220Max5 vulnerabilities
- Td220X5 vulnerabilities
- Intelligent Platforms Proficy Hmi\/Scada Ifix4 vulnerabilities
- Intelligent Platforms Proficy Process Systems3 vulnerabilities
- MDS Pulsenet And MDS Pulsenet Enterprise3 vulnerabilities
- Ml810/3000/3100 Series Switch3 vulnerabilities
- Ms 30003 vulnerabilities
- Mu320E3 vulnerabilities
- Multilink Ml12003 vulnerabilities
- Multilink Ml16003 vulnerabilities
- Multilink Ml24003 vulnerabilities
- Multilink Ml30003 vulnerabilities
- Multilink Ml31003 vulnerabilities
- Multilink Ml8003 vulnerabilities
CVE-2018-19003geex2100e_firmware+2
EPSS score2.56%
GE Mark VIe, EX2100e, EX2100e_Reg, and LS2100e Versions 03.03.28C to 05.02.04C, EX2100e All versions prior to v04.09.00C, EX2100e_Reg All versions prior to v04.09.00C, and LS2100e All versions prior to v04.09.00C The affected versions of the application have a path traversal vulnerability that fails to restrict the ability of an attacker to gain access to restricted information.CVE-2018-17925geifixEPSS score0.30%
Multiple instances of this vulnerability (Unsafe ActiveX Control Marked Safe For Scripting) have been identified in the third-party ActiveX object provided to GE iFIX versions 2.0 - 5.8 by Gigasoft. Only the independent use of the Gigasoft charting package outside the iFIX product may expose users to the reported vulnerability. The reported method shown to impact Internet Explorer is not exposed in the iFIX product, nor is the core functionality of the iFIX product known to be impacted.CVE-2018-5473ged60_line_distance_relay_firmwareEPSS score5.89%
An Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in GE D60 Line Distance Relay devices running firmware Version 7.11 and prior. The SSH functions of the device are vulnerable to buffer overflow conditions that may allow a remote attacker to execute arbitrary code on the device.CVE-2018-5475ged60_line_distance_relay_firmwareEPSS score3.79%
A Stack-based Buffer Overflow issue was discovered in GE D60 Line Distance Relay devices running firmware Version 7.11 and prior. Multiple stack-based buffer overflow vulnerabilities have been identified, which may allow remote code execution.CVE-2018-10615gemds_pulsenet+1EPSS score2.54%
Directory traversal may lead to files being exfiltrated or deleted on the GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior host platform.CVE-2018-10611gemds_pulsenet+1EPSS score4.93%
Java remote method invocation (RMI) input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior may be exploited to allow unauthenticated users to launch applications and support remote code execution through web services.CVE-2018-10613gemds_pulsenet+1EPSS score17.84%
Multiple variants of XML External Entity (XXE) attacks may be used to exfiltrate data from the host Windows platform in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior.CVE-2018-15362gecimplicityEPSS score2.69%
XXE in GE Proficy Cimplicity GDS versions 9.0 R2, 9.5, 10.0CVE-2018-8867gepacsystems_cpu320_firmware+7EPSS score3.38%
In GE PACSystems RX3i CPE305/310 version 9.20 and prior, RX3i CPE330 version 9.21 and prior, RX3i CPE 400 version 9.30 and prior, PACSystems RSTi-EP CPE 100 all versions, and PACSystems CPU320/CRU320 RXi all versions, the device does not properly validate input, which could allow a remote attacker to send specially crafted packets causing the device to become unavailable.CVE-2013-2785geintelligent_platforms_proficy_hmi\/scada_cimplicity+1EPSS score3.77%
Multiple buffer overflows in CimWebServer.exe in the WebView component in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.0 SIM 27, 8.1 before SIM 25, and 8.2 before SIM 19, and Proficy Process Systems with CIMPLICITY, allow remote attackers to execute arbitrary code via crafted data in packets to TCP port 10212, aka ZDI-CAN-1621 and ZDI-CAN-1624.CVE-2013-2811catapultsoftwarecatapult_dnp3_i\/o_driver+3EPSS score1.85%
The (1) Catapult DNP3 I/O driver before 7.2.0.60 and the (2) GE Intelligent Platforms Proficy DNP3 I/O driver before 7.20k, as used in DNPDrv.exe (aka the DNP master station server) in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY and iFIX, allow remote attackers to cause a denial of service (infinite loop) via a crafted DNP3 TCP packet.CVE-2013-2823catapultsoftwarecatapult_dnp3_i\/o_driver+3EPSS score0.76%
The (1) Catapult DNP3 I/O driver before 7.2.0.60 and the (2) GE Intelligent Platforms Proficy DNP3 I/O driver before 7.20k, as used in DNPDrv.exe (aka the DNP master station server) in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY and iFIX, allow physically proximate attackers to cause a denial of service (infinite loop) via crafted input over a serial line.CVE-2013-0652geintelligent_platforms_proficy_real-time_information_portalEPSS score1.96%
GE Intelligent Platforms Proficy Real-Time Information Portal does not restrict access to methods of an unspecified Java class, which allows remote attackers to obtain a username listing via an RMI call.CVE-2013-0653geintelligent_platforms_proficy_hmi\/scada_cimplicity+2EPSS score19.11%
Directory traversal vulnerability in substitute.bcl in the WebView CimWeb subsystem in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to read arbitrary files via a crafted packet.CVE-2013-0651geintelligent_platforms_proficy_real-time_information_portalEPSS score1.31%
The Portal installation process in GE Intelligent Platforms Proficy Real-Time Information Portal stores sensitive information under the web root with insufficient access control, which allows remote attackers to read configuration files, and discover data-source credentials, via a direct request.CVE-2013-0654geintelligent_platforms_proficy_hmi\/scada_cimplicity+2EPSS score3.06%
CimWebServer in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary commands or cause a denial of service (daemon crash) via a crafted packet.CVE-2021-31477gereason_rpv311_firmwareEPSS score2.64%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware and filesystem of the device. The firmware and filesystem contain hard-coded default credentials. An attacker can leverage this vulnerability to execute code in the context of the download user. Was ZDI-CAN-11852.CVE-2021-27452gemu320e_firmwareEPSS score0.27%
The software contains a hard-coded password that could allow an attacker to take control of the merging unit using these hard-coded credentials on the MU320E (all firmware versions prior to v04A00.1).CVE-2021-27430geur_bootloader_binaryEPSS score0.25%
GE UR bootloader binary Version 7.00, 7.01 and 7.02 included unused hardcoded credentials. Additionally, a user with physical access to the UR IED can interrupt the boot sequence by rebooting the UR.CVE-2021-27450gemu320e_firmwareEPSS score0.20%
SSH server configuration file does not implement some best practices. This could lead to a weakening of the SSH protocol strength, which could lead to additional misconfiguration or be leveraged as part of a larger attack on the MU320E (all firmware versions prior to v04A00.1).