ge vulnerabilities

Q: How do I fix ge vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Q: Is ge being exploited right now?

None of the tracked ge CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Q: Which ge CVE should I patch first?

CVE-2023-0755 currently ranks highest (63/100): The affected products are vulnerable to an improper validation of array index, which could allow an attacker .

Recent CVEs affecting ge products. 90 tracked.

ge has 90 tracked vulnerabilities, 30 critical. A fixed release or vendor patch exists for 67. Most recent: 2023-11-30. Highest priority: CVE-2023-0755 (score 63/100).

CVE-2023-5909 HIGH 7.5 UPGRADE UPGRADE KEPServerEX does not properly validate certificates from clients which may allow unauthenticated user
CVE-2023-5908 CRITICAL 9.1 UPGRADE UPGRADE KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being acc
CVE-2023-4487 HIGH 7.8 DOWNGRADE GE CIMPLICITY 2023 is by a process control vulnerability, which could allow a local attacker to insert malici
CVE-2023-3463 MEDIUM 6.6 MITIGATE All versions of GE Digital CIMPLICITY that are not adhering to SDG guidance and accepting documents from untr
CVE-2023-1552 MEDIUM 6.4 UPGRADE ToolboxST prior to version 7.10 is affected by a deserialization vulnerability
CVE-2023-0898 MEDIUM 5.3 MITIGATE General Electric MiCOM S1 Agile is vulnerable to an attacker achieving code execution by placing malicious DL
CVE-2023-0755 CRITICAL 9.8 UPGRADE UPGRADE The affected products are vulnerable to an improper validation of array index, which could allow an attacker
CVE-2023-0754 CRITICAL 9.8 UPGRADE UPGRADE The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to
CVE-2023-0598 HIGH 7.8 DOWNGRADE GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable t
CVE-2022-46732 CRITICAL 9.8 UPGRADE Even if the authentication fails for local service authentication, the requested command could still execute r
CVE-2022-46660 HIGH 7.5 UPGRADE An unauthorized user could alter or write files with full control over the path and content of the file
CVE-2022-46331 HIGH 7.5 UPGRADE An unauthorized user could possibly delete any file on the system
CVE-2022-43977 CRITICAL 9.8 UPGRADE An issue was discovered on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0
CVE-2022-43976 CRITICAL 9.8 UPGRADE An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7
CVE-2022-43975 HIGH 7.5 UPGRADE An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7
CVE-2022-43494 HIGH 7.5 UPGRADE An unauthorized user could be able to read any file on the system, potentially exposing sensitive informatio
CVE-2022-3092 HIGH 7.8 UPGRADE GE CIMPICITY versions 2022 and prior is vulnerable to an out-of-bounds write, which could allow an attac
CVE-2022-3084 HIGH 7.8 UPGRADE GE CIMPICITY versions 2022 and prior is vulnerable when data from a faulting address controls code flow starti
CVE-2022-38469 HIGH 7.5 UPGRADE An unauthorized user with network access and the decryption key could decrypt sensitive data, such as user
CVE-2022-37953 MEDIUM 4.7 UPGRADE An HTTP response splitting vulnerability exists in the AM Gateway Challenge-Response dialog of WorkstationST (
CVE-2022-37952 MEDIUM 4.7 UPGRADE A reflected cross-site scripting (XSS) vulnerability exists in the iHistorian Data Display of WorkstationST (<
CVE-2022-2952 HIGH 7.8 UPGRADE GE CIMPICITY versions 2022 and prior is vulnerable when data from a faulting address controls code flow star
CVE-2022-2948 HIGH 7.8 UPGRADE GE CIMPICITY versions 2022 and prior is vulnerable to a heap-based buffer overflow, which could allow an att
CVE-2022-2848 CRITICAL 9.1 UPGRADE UPGRADE This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPS
CVE-2022-2825 CRITICAL 9.8 UPGRADE UPGRADE This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPS
CVE-2022-2002 HIGH 7.8 UPGRADE GE CIMPICITY versions 2022 and prior is vulnerable when data from faulting address controls code flow star
CVE-2022-24120 MEDIUM 4.6 UPGRADE UPGRADE Certain General Electric Renewable Energy products store cleartext credentials in flash memory
CVE-2022-24119 CRITICAL 9.8 UPGRADE UPGRADE Certain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to
CVE-2022-24118 CRITICAL 9.1 UPGRADE UPGRADE Certain General Electric Renewable Energy products allow attackers to use a code to trigger a reboot into the
CVE-2022-24117 CRITICAL 9.8 UPGRADE UPGRADE Certain General Electric Renewable Energy products download firmware without an integrity check
CVE-2022-24116 CRITICAL 9.8 UPGRADE UPGRADE Certain General Electric Renewable Energy products have inadequate encryption strength
CVE-2022-23921 HIGH 7.5 UPGRADE Exploitation of this vulnerability may result in local privilege escalation and code execution
CVE-2022-21798 HIGH 7.5 MITIGATE The affected product is vulnerable due to cleartext transmission of credentials seen in the CIMPLICITY network
CVE-2021-44477 HIGH 7.5 UPGRADE GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DT
CVE-2021-31477 HIGH 7.3 MITIGATE This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RP
CVE-2021-27454 HIGH 7.8 UPGRADE The software performs an operation at a privilege level higher than the minimum level required, which creates
CVE-2021-27452 HIGH 7.8 UPGRADE The software contains a hard-coded password that could allow an attacker to take control of the merging unit u
CVE-2021-27450 HIGH 7.8 UPGRADE SSH server configuration file does not implement some best practices
CVE-2021-27448 HIGH 7.8 UPGRADE A miscommunication in the file system allows adversaries with access to the MU320E to escalate privileges on t
CVE-2021-27440 CRITICAL 9.8 UPGRADE The software contains a hard-coded password it uses for its own inbound authentication or for outbound communi
CVE-2021-27438 HIGH 8.8 UPGRADE The software contains a hard-coded password it uses for its own inbound authentication or for outbound communi
CVE-2021-27430 HIGH 8.4 DOWNGRADE GE UR bootloader binary Version 7.00, 7.01 and 7.02 included unused hardcoded credentials
CVE-2021-27428 CRITICAL 9.8 UPGRADE UPGRADE GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration too
CVE-2021-27426 CRITICAL 9.8 UPGRADE UPGRADE GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling o
CVE-2021-27424 MEDIUM 5.3 UPGRADE UPGRADE GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide
CVE-2021-27422 HIGH 7.5 UPGRADE UPGRADE GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol
CVE-2021-27420 MEDIUM 5.3 UPGRADE UPGRADE GE UR firmware versions prior to version 8.1x web server task does not properly handle receipt of unsupported
CVE-2021-27418 MEDIUM 5.3 UPGRADE UPGRADE GE UR firmware versions prior to version 8.1x supports web interface with read-only access
CVE-2020-6992 MEDIUM 6.7 UPGRADE A local privilege escalation vulnerability has been identified in the GE Digital CIMPLICITY HMI/SCADA product
CVE-2020-6977 MEDIUM 6.8 MITIGATE MITIGATE A restricted desktop environment escape vulnerability exists in the Kiosk Mode functionality of affected devic
CVE-2020-36549 HIGH 8.8 MITIGATE A vulnerability classified as critical was found in GE Voluson S8
CVE-2020-36548 MEDIUM 5.9 MITIGATE A vulnerability classified as problematic has been found in GE Voluson S8
CVE-2020-36547 MEDIUM 5.9 MITIGATE A vulnerability was found in GE Voluson S8
CVE-2020-27267 CRITICAL 9.1 DOWNGRADE DOWNGRADE KEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial Connectivity (all versi
CVE-2020-27265 CRITICAL 9.8 DOWNGRADE DOWNGRADE KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All ver
CVE-2020-27263 CRITICAL 9.1 DOWNGRADE DOWNGRADE KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All ver
CVE-2020-25197 CRITICAL 9.8 UPGRADE UPGRADE A code injection vulnerability exists in one of the webpages in GE Reason RT430, RT431 & RT434 GNSS clocks in
CVE-2020-25193 MEDIUM 5.3 UPGRADE UPGRADE By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 & RT434 GNSS clocks in firmwar
CVE-2020-16246 MEDIUM 6.1 UPGRADE UPGRADE The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting (XSS), which may allow attackers
CVE-2020-16242 MEDIUM 6.1 UPGRADE UPGRADE The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting (XSS), which may allow an attack
CVE-2020-12017 CRITICAL 9.8 UPGRADE UPGRADE GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05
CVE-2019-6566 HIGH 7.8 UPGRADE GE Communicator, all versions prior to 4.0.517, allows a non-administrative user to replace the uninstaller wi
CVE-2019-6564 HIGH 7.8 UPGRADE GE Communicator, all versions prior to 4.0.517, allows a non-administrative user to place malicious files with
CVE-2019-6548 CRITICAL 9.8 UPGRADE GE Communicator, all versions prior to 4.0.517, contains two backdoor accounts with hardcoded credentials, whi
CVE-2019-6546 HIGH 7.8 UPGRADE GE Communicator, all versions prior to 4.0.517, allows an attacker to place malicious files within the working
CVE-2019-6544 MEDIUM 5.6 UPGRADE GE Communicator, all versions prior to 4.0.517, has a service running with system privileges that may allow an
CVE-2019-18255 MEDIUM 5.5 UPGRADE HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configura
CVE-2019-18243 MEDIUM 5.5 UPGRADE HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configura
CVE-2019-13559 HIGH 7.8 MITIGATE GE Mark VIe Controller is shipped with pre-configured hard-coded credentials that may allow root-user access t
CVE-2019-13554 HIGH 8.8 MITIGATE GE Mark VIe Controller has an unsecured Telnet protocol that may allow a user to create an authenticated sessi
CVE-2019-10966 MEDIUM 5.3 MITIGATE MITIGATE In GE Aestiva and Aespire versions 7100 and 7900, a vulnerability exists where serial devices are connected vi
CVE-2018-8867 HIGH 7.5 UPGRADE UPGRADE In GE PACSystems RX3i CPE305/310 version 9.20 and prior, RX3i CPE330 version 9.21 and prior, RX3i CPE 400 vers
CVE-2018-5475 CRITICAL 9.8 UPGRADE A Stack-based Buffer Overflow issue was discovered in GE D60 Line Distance Relay devices running firmware Vers
CVE-2018-5473 CRITICAL 9.8 UPGRADE An Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in GE D60 Line
CVE-2018-19003 HIGH 7.5 UPGRADE UPGRADE GE Mark VIe, EX2100e, EX2100e_Reg, and LS2100e Versions 03.03.28C to 05.02.04C, EX2100e All versions prior to
CVE-2018-17925 MEDIUM 4.8 UPGRADE Multiple instances of this vulnerability (Unsafe ActiveX Control Marked Safe For Scripting) have been identifi
CVE-2018-15362 CRITICAL 9.1 DOWNGRADE XXE in GE Proficy Cimplicity GDS versions 9.0 R2, 9.5, 10.0
CVE-2018-10615 HIGH 8.1 UPGRADE Directory traversal may lead to files being exfiltrated or deleted on the GE MDS PulseNET and MDS PulseNET Ent
CVE-2018-10613 HIGH 7.5 UPGRADE Multiple variants of XML External Entity (XXE) attacks may be used to exfiltrate data from the host Windows pl
CVE-2018-10611 CRITICAL 9.8 UPGRADE Java remote method invocation (RMI) input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 an
CVE-2017-7908 HIGH 7.6 UPGRADE UPGRADE A heap-based buffer overflow exists in the third-party product Gigasoft, v5 and prior, included in GE Communic
CVE-2017-7905 CRITICAL 9.8 UPGRADE UPGRADE A Weak Cryptography for Passwords issue was discovered in General Electric (GE) Multilin SR 750 Feeder Protect
CVE-2017-14008 CRITICAL 9.8 MITIGATE GE Centricity PACS RA1000, diagnostic image analysis, all current versions are affected these devices use defa
CVE-2017-14006 CRITICAL 9.8 DOWNGRADE GE Xeleris versions 1.0,1.1,2.1,3.0,3.1, medical imaging systems, all current versions are affected, these dev
CVE-2017-14004 CRITICAL 9.8 MITIGATE GE GEMNet License server (EchoServer) all current versions are affected these devices use default or hard-code
CVE-2017-14002 CRITICAL 9.8 MITIGATE GE Infinia/Infinia with Hawkeye 4 medical imaging systems all current versions are affected these devices use
CVE-2017-12732 MEDIUM 6.8 UPGRADE A Stack-based Buffer Overflow issue was discovered in GE CIMPLICITY Versions 9.0 and prior
CVE-2016-9360 MEDIUM 6.7 UPGRADE UPGRADE An issue was discovered in General Electric (GE) Proficy HMI/SCADA iFIX Version 5.8 SIM 13 and prior versions,
CVE-2015-3976 MEDIUM 5.4 MITIGATE UPGRADE Cross-site scripting (XSS) vulnerability in GE Multilink ML810/3000/3100 series switch 5.2.0 and earlier, and
CVE-2012-6663 HIGH 7.5 MITIGATE MITIGATE General Electric D20ME devices are not properly configured and reveal plaintext passwords.

FAQ

How do I fix ge vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is ge being exploited right now?

None of the tracked ge CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which ge CVE should I patch first?

CVE-2023-0755 currently ranks highest (63/100): The affected products are vulnerable to an improper validation of array index, which could allow an attacker .

Products

RSS feed for ge · ← Back to latest CVEs