Multiple Vulnerabilities in GE MS 3000
view advisory published 2022-11-02
E.ON Pentesting Team has found several vulnerabilities in the firmware of GE Grid Solution's MS 3000. These include an unprotected and open debug service, web service access without authentication or encryption and directory traversal.
01
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-43977US | critical9.8 | — | ||
An issue was discovered on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. The debug port accessible via TCP (a qconn service) lacks access control. | ||||
| CVE-2022-43976US | critical9.8OT elevated | — | ||
An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. Direct access to the API is possible on TCP port 8888 via programs… | ||||
| CVE-2022-43975US | high7.5 | — | ||
An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. A vulnerability in the web server allows arbitrary files and confi… | ||||
02
references
External citations — patches, advisories, analysis.
03
remediations (3)
- FixedGE Grid Solutions MS 3000 firmware <3.7.6.25p0_3.2.2.17p0_4.7p0 installed on GE Grid Solutions MS 3000
Update to the latest firmware version, at least 3.7.6.25p0_3.2.2.17p0_4.7p0.
- FixedGE Grid Solutions MS 3000 firmware <3.7.6.25p0_3.2.2.17p0_4.7p0 installed on GE Grid Solutions MS 3000
Update to the latest firmware version, at least 3.7.6.25p0_3.2.2.17p0_4.7p0.
- FixedGE Grid Solutions MS 3000 firmware <3.7.6.25p0_3.2.2.17p0_4.7p0 installed on GE Grid Solutions MS 3000
Update to the latest firmware version, at least 3.7.6.25p0_3.2.2.17p0_4.7p0.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan