CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2021-27428
Critical (9.8) in ge. EPSS 1.2% chance of exploitation in the next 30 days.
GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without appropriate privileges. The weakness is assessed, and mitigation is implemented in firmware Version 8.10.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
- CWE
- CWE-434
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ge:multilin_b30_firmware
- ge:multilin_b90_firmware
- ge:multilin_c30_firmware
- ge:multilin_c60_firmware
- ge:multilin_c70_firmware
- ge:multilin_c95_firmware
- ge:multilin_d30_firmware
- ge:multilin_d60_firmware
- ge:multilin_f35_firmware
- ge:multilin_f60_firmware
- ge:multilin_g30_firmware
- ge:multilin_g60_firmware
- ge:multilin_l30_firmware
- ge:multilin_l60_firmware
- ge:multilin_l90_firmware
- ge:multilin_m60_firmware
- ge:multilin_n60_firmware
- ge:multilin_t35_firmware
- ge:multilin_t60_firmware