CVE-2017-7905

mediumPriorität · verfolgen · 39OT-Risiko · erhöhtEPSS 0.013 · 70. PerzentilEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.28% (70th) EPSS

CVSS 5 · medium

Is it mine?

65 products

Prüfe deine Angriffsfläche

Who says so?

3 sources

cnnvd · enisa_euvd · cisa_csaf_ot

EPSS · bewertet 2026-10-27

A Weak Cryptography for Passwords issue was discovered in General Electric (GE) Multilin SR 750 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 760 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 469 Motor Protection Relay, firmware versions prior to Version 5.23; SR 489 Generator Protection Relay, firmware versions prior to Version 4.06; SR 745 Transformer Protection Relay, firmware versions prior to Version 5.23; SR 369 Motor Protection Relay, all firmware versions; Multilin Universal Relay, firmware Version 6.0 and prior versions; and Multilin URplus (D90, C90, B95), all versions. Ciphertext versions of user passwords were created with a non-random initialization vector leaving them susceptible to dictionary attacks. Ciphertext of user passwords can be obtained from the front LCD panel of affected products and through issued Modbus commands.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.

Mitigation339 Motor Protection Relay firmwarecisa_csaf_ot
B95Plus: firmware Version 1.03
Mitigation345 Transformer Protection Relay firmwarecisa_csaf_ot
B95Plus: firmware Version 1.03
Mitigation350 Feeder Protection Relay firmwarecisa_csaf_ot
B95Plus: firmware Version 1.03
Mitigation369 Motor Protection Relaycisa_csaf_ot
B95Plus: firmware Version 1.03
Mitigation369 Motor Protection Relay firmwarecisa_csaf_ot
B95Plus: firmware Version 1.03
Mitigation469 Motor Protection Relaycisa_csaf_ot
B95Plus: firmware Version 1.03
Mitigation469 Motor Protection Relay firmwarecisa_csaf_ot
B95Plus: firmware Version 1.03
Mitigation489 Generator Protection Relaycisa_csaf_ot
B95Plus: firmware Version 1.03
Mitigation489 Generator Protection Relay firmwarecisa_csaf_ot
B95Plus: firmware Version 1.03
Mitigation745 Transformer Protection Relaycisa_csaf_ot
B95Plus: firmware Version 1.03
Mitigation745 Transformer Protection Relay firmwarecisa_csaf_ot
B95Plus: firmware Version 1.03
Mitigation750 Feeder Protection Relaycisa_csaf_ot
B95Plus: firmware Version 1.03
Mitigation750 Feeder Protection Relay firmwarecisa_csaf_ot
B95Plus: firmware Version 1.03
Mitigation760 Feeder Protection Relaycisa_csaf_ot
B95Plus: firmware Version 1.03
Mitigation760 Feeder Protection Relay firmwarecisa_csaf_ot
B95Plus: firmware Version 1.03
MitigationB95Plus firmwarecisa_csaf_ot
B95Plus: firmware Version 1.03
MitigationMM200 Motor Management System firmwarecisa_csaf_ot
B95Plus: firmware Version 1.03
MitigationMM300 Motor Management Relay firmwarecisa_csaf_ot
B95Plus: firmware Version 1.03
MitigationMX350 Relay firmwarecisa_csaf_ot
B95Plus: firmware Version 1.03
MitigationRPTCS firmwarecisa_csaf_ot
B95Plus: firmware Version 1.03
MitigationT1000 Switch firmwarecisa_csaf_ot
B95Plus: firmware Version 1.03
MitigationURplus (D90 C90 B95)cisa_csaf_ot
B95Plus: firmware Version 1.03
MitigationURplus firmwarecisa_csaf_ot
B95Plus: firmware Version 1.03
MitigationUniversal Relay firmwarecisa_csaf_ot
B95Plus: firmware Version 1.03

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–critical · 5–9.8

v2.05mediumAV:N/AC:L/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 2.9

v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.08.1highCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.09criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-326USprimärCWE-330USprimärCWE-522USprimärCWE-261USCWE-261US

betroffene Produkte (65)

Betroffene Produkte und Versionsbereiche.

339 Motor Protection Relay firmware: versions prior to Version 2.30alle Versionencisa_csaf_otUS
345 Transformer Protection Relay firmware: versions prior to Version 2.30alle Versionencisa_csaf_otUS
350 Feeder Protection Relay firmware: versions prior to Version 2.30alle Versionencisa_csaf_otUS
369 Motor Protection Relay firmware: versions prior to Version 3.63alle Versionencisa_csaf_otUS
369 Motor Protection Relay: Version 3.63alle Versionencisa_csaf_otUS
469 Motor Protection Relay firmware: versions prior to Version 5.23alle Versionencisa_csaf_otUS
469 Motor Protection Relay: Version 5.23alle Versionencisa_csaf_otUS
489 Generator Protection Relay firmware: versions prior to Version 4.06alle Versionencisa_csaf_otUS
489 Generator Protection Relay: Version 4.06alle Versionencisa_csaf_otUS
745 Transformer Protection Relay firmware: versions prior to Version 5.23alle Versionencisa_csaf_otUS
745 Transformer Protection Relay: Version 5.23alle Versionencisa_csaf_otUS
750 Feeder Protection Relay firmware: versions prior to Version 7.47alle Versionencisa_csaf_otUS
750 Feeder Protection Relay: Version 7.47alle Versionencisa_csaf_otUS
760 Feeder Protection Relay firmware: versions prior to Version 7.47alle Versionencisa_csaf_otUS
760 Feeder Protection Relay: Version 7.47alle Versionencisa_csaf_otUS
B95Plus firmware: Version 1.03alle Versionencisa_csaf_otUS
MM200 Motor Management System firmware: versions prior to Version 1.25alle Versionencisa_csaf_otUS
MM300 Motor Management Relay firmware: versions prior to Version 1.71alle Versionencisa_csaf_otUS
MX350 Relay firmware: versions prior to Version 1.27alle Versionencisa_csaf_otUS
RPTCS firmware: versions prior to Version 1.29alle Versionencisa_csaf_otUS

20 von 65 angezeigt

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

ICSA-17-117-01BGE Multilin SR, UR, and URplus Protective Relays (Update B)2017-04-27icsa · cisa_csaf_otUS
ATTENTION: Remotely exploitable/low skill level to exploit.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cisa_csaf_ot NVD CVE.org MITRE

veröffentlicht 2017-06-30geändert 2026-06-17

verwandt (2,972)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2021-40655US	high7.5OT kritisch	86.7% (100th)	KEV	2021-09-24
An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php…
CVE-2021-30116US	critical9.8OT kritisch	85.7% (100th)	KEV	2021-07-09
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the insta…
CVE-2021-22681US	critical9.8OT kritisch	63.6% (99th)	KEV	2021-03-03
Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell…
CVE-2020-29583US	critical9.8OT kritisch	90.2% (100th)	KEV	2020-12-22
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the fi…
CVE-2018-18325US	high7.5OT kritisch	74.0% (99th)	KEV	2019-07-03
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.

+2967 weitere

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

http://www.gegridsolutions.com/Patchcnnvd
https://ics-cert.us-cert.gov/advisories/ICSA-17-117-01A cnnvd
https://www.securityfocus.com/bid/98063 cnnvd
http://www.securityfocus.com/bid/98063 enisa_euvd
https://ics-cert.us-cert.gov/advisories/ICSA-17-117-01A enisa_euvd
http://www.securityfocus.com/bid/98063Third Party AdvisoryVDB Entrynvd
https://ics-cert.us-cert.gov/advisories/ICSA-17-117-01APatchThird Party AdvisoryUS Government Resourcenvd

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan