Critical Flaws Affecting GE’s Universal Relay Pose Threat to Electric Utilities

The U.S. Cybersecurity and Infrastructure Protection Agency (CISA) has warned of significant security shortcomings in GE’s Universal Relay (UR) spouse and children of ability management gadgets.

“Prosperous exploitation of these vulnerabilities could allow an attacker to obtain delicate info, reboot the UR, get privileged entry, or trigger a denial-of-services affliction,” the company mentioned in an advisory published on March 16.

GE’s universal relays allow built-in monitoring and metering, substantial-pace communications, and present simplified electrical power management for the safety of vital assets.

The flaws, which have an effect on a range of UR advanced safety and manage relays, such as B30, B90, C30, C60, C70, C95, D30, D60, F35, F60, G30, G60, L30, L60, L90, M60, N60, T35 and T60, were tackled by GE with the release of an up-to-date model of the UR firmware (variation 8.10) created out there on December 24, 2020.

The patches resolve a total of 9 vulnerabilities, the most crucial of which concerns an insecure default variable initialization, referring to the initialization of an inside variable in the software package with an insecure value. The vulnerability (CVE-2021-27426) is also rated 9.8 out of 10, building it a vital situation.

“By sending a specifically crafted ask for, an attacker could exploit this vulnerability to bypass obtain limits,” IBM mentioned in its warn.A second severe vulnerability relates to unused tricky-coded qualifications in the bootloader binary (CVE-2021-27430, CVSS score 8.4), which could be exploited by an attacker “with physical entry to the UR [Intelligent Electronic Device] can interrupt the boot sequence by rebooting the UR.”

Also fastened by GE is yet another large severity flaw (CVE-2021-27428, CVSS score 7.5) that could permit an unauthorized person to improve firmware without having ideal privileges.

4 other vulnerabilities contain two poor enter validations (CVE-2021-27418, CVE-2021-27420) and two flaws relating to exposure of sensitive information to unauthorized functions (CVE-2021-27422, CVE-2021-27424), thus exposing the product to cross-web site scripting assaults, permitting an attacker to accessibility critical information with out authentication, and even render the webserver unresponsive.

And lastly, all versions of UR firmware prior to 8.1x have been identified to use weak encryption and MAC algorithms for SSH communication, earning them additional susceptible to brute-power attacks.

“CISA endorses end users consider defensive steps to decrease the risk of exploitation of these vulnerabilities,” the agency said. “Reduce community exposure for all command process equipment and/or techniques and guarantee that they are not obtainable from the Online, [and] track down control system networks and remote units driving firewalls and isolate them from the organization community.”

Fibo Quantum