SB2022040406 - Multiple vulnerabilities in General Electric Renewable Energy MDS Radios
Published: April 4, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Hidden functionality (CVE-ID: CVE-2022-24119)
The vulnerability allows a remote attacker to compromise vulnerable system
The vulnerability exists due to hidden functionality (backdoor) is present in software. A remote attacker can use this functionality to gain full access to the application and compromise the affected system.
2) Inadequate Encryption Strength (CVE-ID: CVE-2022-24116)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to inadequate encryption strength in the wireless security software and chipset implementations. A remote attacker on the local network can gain access to the system.
3) Resource exhaustion (CVE-ID: CVE-2022-24118)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker on the local network can use the authentication code to cause affected series radios to reset back to the factory default configuration and reboot.
4) Unprotected storage of credentials (CVE-ID: CVE-2022-24120)
The vulnerability allows a local attacker to gain access to other users' credentials.
The vulnerability exists due to application stored credentials in plain text in a configuration file on the system. An attacker with physical access can view contents of the configuration file and gain access to passwords for 3rd party integration.
5) Download of code without integrity check (CVE-ID: CVE-2022-24117)
The vulnerability allows a remote user to compromise the affected system
The vulnerability exists due to software does not perform software integrity check when downloading updates. A remote administrator gain full control over the affected system after a successful software update.
Remediation
Install update from vendor's website.