Missing Authentication for Critical Function in GE products - CVE-2020-12017

Vulnerability details

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to an insufficient authentication mechanism in the web application. A remote attacker on the local network can send a specially crafted request to execute arbitrary commands, change the password of the "configuration" user account to modify the configuration of the device, or bypass the authentication required to configure the device and reboot the system. 

Affected software

How to mitigate CVE-2020-12017

External References

• https://www.us-cert.gov/ics/advisories/icsa-20-154-05
• https://www.gegridsolutions.com/app/ViewFiles.aspx?prod=RT430&type=7

Related Security Bulletins

• Missing Authentication for Critical Function in GE Grid Solutions Reason RT Clocks