CVE-2025-27253

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to bypass firewall rules or to send malicious traffic in the network.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

Weakness enumeration

CWE-15

Affected software

No affected versions have been published.

Timeline

Published: Mar 10, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-272548.0CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass. The software's startup authenticatio CVE-2025-272558.0Use of Hard-coded Credentials vulnerability in GE Vernova EnerVista UR Setup allows Privilege Escalation. The local user database is encrypt CVE-2025-272568.3Missing Authentication for Critical Function vulnerability in GE Vernova Enervista UR Setup application allows Authentication Bypass due to CVE-2025-272576.1Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a m CVE-2025-272589.8Ericsson Network Manager (ENM) versions prior to ENM 25.1 GA contain a vulnerability, if exploited, can result in an escalation of privilege CVE-2025-272595.4Ericsson Network Manager versions prior to ENM 25.2 GA contain a vulnerability that, if exploited, can exfiltrate limited data or redirect v CVE-2025-27268.0A vulnerability, which was classified as critical, has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18 CVE-2025-272607.5Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains an Improper Filtering of Special Elements vulnerability which, if exploited,CVE-2025-272619.8Ericsson Indoor Connect 8855 contains an SQL injection vulnerability which if exploited can result in unauthorized disclosure or modificatio CVE-2025-272627.8Ericsson Indoor Connect 8855 contains a command injection vulnerability which if exploited can result in an escalation of privileges.CVE-2025-272638.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Creativeitem Doctor Appointment Bookin CVE-2025-272647.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creativeitem Doctor