CVE-2025-27253

March 12, 2025, 11:15 a.m.

6.1
Medium

Description

An improper input validation in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that enstablishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to bypass firewall rules or to send malicious traffic in the network

Product(s) Impacted

Product Versions
GE Vernova UR IED family devices
  • 7.0 up to 8.60

Weaknesses

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27253

Tags

CWE-20
prodsec@nozominetworks.com
2025-03-10
CVE-2025-27253

CVSS Score

6.1 / 10

CVSS Data

  • Attack Vector: ADJACENT_NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: CHANGED
  • Confidentiality Impact: LOW
  • Integrity Impact: NONE
  • Availability Impact: LOW
    • View Vector String

    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

Date

  • Published: March 10, 2025, 9:15 a.m.
  • Last Modified: March 12, 2025, 11:15 a.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

prodsec@nozominetworks.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.