5.3
Medium
CVE-2021-27418 GE UR firmware versions prior to version 8.1x supports web interface with read-only access
Description
GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting attacks, which may be used to send a malicious script. Also, UR Firmware web server does not perform HTML encoding of user-supplied strings.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| UR family 8.1 | earliest → < 8.1x | 8.1x |
Other CVEs of UR family
The 6 CVEs of UR family →
CVE-2021-27422
GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol
7.5
High
CVE-2021-27426
GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the…
9.8
Critical
CVE-2021-27424
GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide
5.3
Medium
CVE-2021-27428
GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool –…
9.8
Critical