https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-27428.htmlhttps://patchthecve.com/cve/CVE-2021-27428.htmlWed, 17 Jun 2026 03:44:50 +0000CRITICAL 9.8: GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without approprihttps://patchthecve.com/cve/CVE-2021-27426.htmlhttps://patchthecve.com/cve/CVE-2021-27426.htmlWed, 17 Jun 2026 03:44:50 +0000CRITICAL 9.8: GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a “Factory” user.https://patchthecve.com/cve/CVE-2021-27424.htmlhttps://patchthecve.com/cve/CVE-2021-27424.htmlWed, 17 Jun 2026 03:44:49 +0000MEDIUM 5.3: GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. GE was made aware a “Last-key pressed” MODBUS register can be used to gain unauthorized information.https://patchthecve.com/cve/CVE-2021-27422.htmlhttps://patchthecve.com/cve/CVE-2021-27422.htmlWed, 17 Jun 2026 03:44:49 +0000HIGH 7.5: GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol. It allows sensitive information exposure without authentication.https://patchthecve.com/cve/CVE-2021-27420.htmlhttps://patchthecve.com/cve/CVE-2021-27420.htmlWed, 17 Jun 2026 03:44:49 +0000MEDIUM 5.3: GE UR firmware versions prior to version 8.1x web server task does not properly handle receipt of unsupported HTTP verbs, resulting in the web server becoming temporarily unresponsive after receiving a series of unsupported HTTP requests. When unresponsive, the web server is inaccessible. By itself,https://patchthecve.com/cve/CVE-2021-27418.htmlhttps://patchthecve.com/cve/CVE-2021-27418.htmlWed, 17 Jun 2026 03:44:49 +0000MEDIUM 5.3: GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting attacks, which may be used to send a malicious script. Also, UR Firmware web server does not perform HTML e