CVE-2022-24117

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Certain General Electric Renewable Energy products download firmware without an integrity check. This affects iNET and iNET II before 8.3.0, SD before 6.4.7, TD220X before 2.0.16, and TD220MAX before 1.2.6.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-494

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-06Patch, Third Party Advisory, US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-06Patch, Third Party Advisory, US Government Resource

Timeline

Published: Dec 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-241189.1Certain General Electric Renewable Energy products allow attackers to use a code to trigger a reboot into the factory default configuration.CVE-2022-241199.8Certain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to the device configuration shell CVE-2022-24124.8The Better Tag Cloud WordPress plugin through 0.99.5 does not sanitise and escape some of its settings, which could allow high privilege use CVE-2022-241204.6Certain General Electric Renewable Energy products store cleartext credentials in flash memory. This affects iNET and iNET II before 8.3.0.CVE-2022-241217.5SQL Injection vulnerability discovered in Unified Office Total Connect Now that would allow an attacker to extract sensitive information thr CVE-2022-241227.8kernel/ucount.c in the Linux kernel 5.14 through 5.16.4, when unprivileged user namespaces are enabled, allows a use-after-free and privileg CVE-2022-241239.0MarkText through 0.16.3 does not sanitize the input of a mermaid block before rendering. This could lead to Remote Code Execution via a .md CVE-2022-241247.5The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/g CVE-2022-241258.8The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send arbitrary push request CVE-2022-241269.8A buffer overflow in the NRSessionSearchResult parser in Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allows remote attackers CVE-2022-241275.4A Stored Cross-Site Scripting (XSS) vulnerability was discovered in ProjectGeneral/edit_project_settings.php in REDCap 12.0.11. This issue a CVE-2022-241288.0Timescale TimescaleDB 1.x and 2.x before 2.5.2 may allow privilege escalation during extension installation. The installation process uses c