CRITICAL🇵🇱 Wersja polska

CVE-2017-7905

CVSS 9.8v3.0pub. 2017-06-30upd. 2026-05-13

A Weak Cryptography for Passwords issue was discovered in General Electric (GE) Multilin SR 750 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 760 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 469 Motor Protection Relay, firmware versions prior to Version 5.23; SR 489 Generator Protection Relay, firmware versions prior to Version 4.06; SR 745 Transformer Protection Relay, firmware versions prior to Version 5.23; SR 369 Motor Protection Relay, all firmware versions; Multilin Universal Relay, firmware Version 6.0 and prior versions; and Multilin URplus (D90, C90, B95), all versions. Ciphertext versions of user passwords were created with a non-random initialization vector leaving them susceptible to dictionary attacks. Ciphertext of user passwords can be obtained from the front LCD panel of affected products and through issued Modbus commands.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Ge Multilin Sr 369 Motor Protection Relay

    HW
    Ge
    all versions

  • Ge Multilin Sr 369 Motor Protection Relay Firmware

    OS
    Ge
    all versions

  • Ge Multilin Sr 469 Motor Protection Relay

    HW
    Ge
    all versions

  • Ge Multilin Sr 469 Motor Protection Relay Firmware

    OS
    Ge
    ≤ 2.90

  • Ge Multilin Sr 489 Generator Protection Relay

    HW
    Ge
    all versions

  • Ge Multilin Sr 489 Generator Protection Relay Firmware

    OS
    Ge
    ≤ 1.53

  • Ge Multilin Sr 745 Transformer Protection Relay

    HW
    Ge
    all versions

  • Ge Multilin Sr 745 Transformer Protection Relay Firmware

    OS
    Ge
    ≤ 2.85

  • Ge Multilin Sr 750 Feeder Protection Relay

    HW
    Ge
    all versions

  • Ge Multilin Sr 750 Feeder Protection Relay Firmware

    OS
    Ge
    ≤ 5.02

  • Ge Multilin Sr 760 Feeder Protection Relay

    HW
    Ge
    all versions

  • Ge Multilin Sr 760 Feeder Protection Relay Firmware

    OS
    Ge
    ≤ 5.02

  • Ge Multilin Universal Relay

    HW
    Ge
    all versions

  • Ge Multilin Universal Relay Firmware

    OS
    Ge
    ≤ 6.0

  • Ge Multilin Urplus B95

    HW
    Ge
    all versions

  • Ge Multilin Urplus B95 Firmware

    OS
    Ge
    all versions

  • Ge Multilin Urplus C90

    HW
    Ge
    all versions

  • Ge Multilin Urplus C90 Firmware

    OS
    Ge
    all versions

  • Ge Multilin Urplus D90

    HW
    Ge
    all versions

  • Ge Multilin Urplus D90 Firmware

    OS
    Ge
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2023-5908CRITICAL9.1PL ✓same vendor

Buffer overflow w KEPServerEX umożliwiający crash lub wyciek danych

CVE-2022-2848CRITICAL9.1PL ✓same vendor

Zdalne wykonanie kodu w Kepware KEPServerEX – heap buffer overflow

CVE-2022-2825CRITICAL9.8PL ✓same vendor

RCE bez uwierzytelnienia w Kepware KEPServerEX — stack-based buffer overflow

CVE-2023-0754CRITICAL9.8PL ✓same vendor

Integer overflow umożliwiający RCE w produktach GE Digital i PTC Kepware

CVE-2023-0755CRITICAL9.8PL ✓same vendor

Nieprawidłowa walidacja indeksu tablicy w produktach GE/PTC — RCE