CVE-2014-5419

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier use the same RSA private key across different customers' installations, which makes it easier for remote attackers to obtain the cleartext content of network traffic by reading this key from a firmware image and then sniffing the network.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-321 CWE-310

Affected software

Vendor	Product	Versions
GE	Multilink ML800/1200/1600/2400	<= 4.2.1
GE	ML810/3000/3100 series switch	<= 5.2.0

References

http://www.gedigitalenergy.com/products/support/multilink/MLSB1214.pdfVendor Advisory
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-013-04a.json
https://www.cisa.gov/news-events/ics-advisories/icsa-15-013-04a
http://www.gedigitalenergy.com/products/support/multilink/MLSB1214.pdfVendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-15-013-04Third Party Advisory, US Government Resource

Timeline

Published: Jan 17, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-54203.5CareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 has a hardcoded application password, which makes it easier for rem CVE-2014-54216.8CareFusion Pyxis SupplyStation 8.1 with hardware test tool 1.0.16 and earlier has a hardcoded database password, which makes it easier for l CVE-2014-54229.7CareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 has a hardcoded service password, which makes it easier for remote CVE-2014-54231.9CareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 allows local users to obtain potentially sensitive information by r CVE-2014-54247.5Rockwell Automation Connected Components Workbench (CCW) before 7.00.00 allows remote attackers to cause a denial of service (application cr CVE-2014-54255.0IOServer before Beta2112.exe allows remote attackers to cause a denial of service (out-of-bounds read and master entry consumption) via a nu CVE-2014-54265.0MatrikonOPC OPC Server for DNP3 1.2.3 and earlier allows remote attackers to cause a denial of service (unhandled exception and DNP3 process CVE-2014-54275.0Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonW CVE-2014-542810.0Unrestricted file upload vulnerability in unspecified web services in Johnson Controls Metasys 4.1 through 6.5, as used in Application and D CVE-2014-54295.0DNP Master Driver 3.02 and earlier in Elipse SCADA 2.29 build 141 and earlier, E3 1.0 through 4.6, and Elipse Power 1.0 through 4.6 allows r CVE-2014-54306.9Untrusted search path vulnerability in ABB RobotStudio 5.6x before 5.61.02 and Test Signal Viewer 1.5 allows local users to gain privileges CVE-2014-54316.8Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 contains a hard-coded pass