CVE-2021-27422

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol. It allows sensitive information exposure without authentication.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-319

Affected software

Vendor	Product	Versions
GE	UR family	>= unspecified, < 8.1x

References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02Mitigation, Third Party Advisory, US Government Resource
https://www.gegridsolutions.com/Passport/Login.aspxPermissions Required, Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02Mitigation, Third Party Advisory, US Government Resource
https://www.gegridsolutions.com/Passport/Login.aspxPermissions Required, Vendor Advisory

Timeline

Published: Mar 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-274245.3GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. GE was made aware a “Last-key pr CVE-2021-274259.8Cesanta Software Mongoose-OS v2.17.0 is vulnerable to integer wrap-around in function mm_malloc. This improper memory assignment can lead to CVE-2021-274269.8GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is CVE-2021-274279.8RIOT OS version 2020.01.1 is vulnerable to integer wrap-around in its implementation of calloc function, which can lead to arbitrary memory CVE-2021-274289.8GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This U CVE-2021-274297.8Texas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values. This can trigger an integer overflow vulnerab CVE-2021-274306.8GE UR bootloader binary Version 7.00, 7.01 and 7.02 included unused hardcoded credentials. Additionally, a user with physical access to the CVE-2021-274319.8ARM CMSIS RTOS2 versions prior to 2.1.3 are vulnerable to integer wrap-around inosRtxMemoryAlloc (local malloc equivalent) function, which c CVE-2021-274327.5OPC Foundation UA .NET Standard versions prior to 1.4.365.48 and OPC UA .NET Legacy are vulnerable to an uncontrolled recursion, which may a CVE-2021-274339.8ARM mbed-ualloc memory library version 1.3.0 is vulnerable to integer wrap-around in function mbed_krbs, which can lead to arbitrary memory CVE-2021-274347.5Products with Unified Automation .NET based OPC UA Client/Server SDK Bundle: Versions V3.0.7 and prior (.NET 4.5, 4.0, and 3.5 Framework ver CVE-2021-274359.8ARM mbed product Version 6.3.0 is vulnerable to integer wrap-around in malloc_wrapper function, which can lead to arbitrary memory allocatio