Multiple Vulnerabilities in GE MS 3000
Advisory ansehen veröffentlicht 2022-11-02
E.ON Pentesting Team has found several vulnerabilities in the firmware of GE Grid Solution's MS 3000. These include an unprotected and open debug service, web service access without authentication or encryption and directory traversal.
01
beschreibt (3)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-43977US | critical9.8 | — | ||
An issue was discovered on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. The debug port accessible via TCP (a qconn service) lacks access control. | ||||
| CVE-2022-43976US | critical9.8OT erhöht | — | ||
An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. Direct access to the API is possible on TCP port 8888 via programs… | ||||
| CVE-2022-43975US | high7.5 | — | ||
An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. A vulnerability in the web server allows arbitrary files and confi… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
03
Behebungen (3)
- BehobenGE Grid Solutions MS 3000 firmware <3.7.6.25p0_3.2.2.17p0_4.7p0 installed on GE Grid Solutions MS 3000
Update to the latest firmware version, at least 3.7.6.25p0_3.2.2.17p0_4.7p0.
- BehobenGE Grid Solutions MS 3000 firmware <3.7.6.25p0_3.2.2.17p0_4.7p0 installed on GE Grid Solutions MS 3000
Update to the latest firmware version, at least 3.7.6.25p0_3.2.2.17p0_4.7p0.
- BehobenGE Grid Solutions MS 3000 firmware <3.7.6.25p0_3.2.2.17p0_4.7p0 installed on GE Grid Solutions MS 3000
Update to the latest firmware version, at least 3.7.6.25p0_3.2.2.17p0_4.7p0.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan