Input validation error in GE Hardware solutions

#VU24308 Input validation error in GE Hardware solutions

Published: 2020-01-15

Vulnerability identifier: #VU24308

Vulnerability risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13524

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vendor: GE

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send specially manipulated packets, cause the module state to change to halt-mode and cause a denial of service condition on the target device.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

PACSystems RSTi-EP CPE 100: All versions

RX3i CPE330: All versions

RX3i CPE 400: All versions

PACSystems RX3i CPE305: All versions

PACSystems RX3i CPE310: All versions

PACSystems RSTi-EP CPE 115: All versions

PACSystems RX3i CPE302: All versions

PACSystems CRU320: All versions

PACSystems RX3i CPL410: All versions

External links
http://ics-cert.us-cert.gov/advisories/icsa-20-014-01

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Latest bulletins with this vulnerability

OpenSUSE Linux update for git

Gentoo update for Git

OpenSUSE Linux update for git

Red Hat update for git

Denial of service in GE PACSystems RX3i