GE Multilink Uncontrolled Resource Consumption

Summary

CVE	CVE-2014-5418
State	PUBLISHED
Assigner	icscert
Source Priority	CVE Program / NVD first with legacy fallback
Published	2015-01-17 02:59:01 UTC
Updated	2026-05-06 22:30:45 UTC
Description	GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier allow remote attackers to cause a denial of service (resource consumption or reboot) via crafted packets.

Risk And Classification

Primary CVSS: v2.0 7.8 from [email protected]

AV:N/AC:L/Au:N/C:N/I:N/A:C

Problem Types: CWE-400 | CWE-399 | CWE-400 CWE-400

Version	Source	Type	Score	Vector
2.0	[email protected]	Primary	7.8	`AV:N/AC:L/Au:N/C:N/I:N/A:C`
2.0	[email protected]	Secondary	5	`AV:N/AC:L/Au:N/C:N/I:N/A:P`
2.0	CNA	CVSS	5	`AV:N/AC:L/Au:N/C:N/I:N/A:P`

CVSS v2.0 Breakdown

Access Vector

Network

Access Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Complete

AV:N/AC:L/Au:N/C:N/I:N/A:C

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Hardware	Ge	Multilink Ml1200	-	All	All	All
Operating System	Ge	Multilink Ml1200 Firmware	All	All	All	All
Hardware	Ge	Multilink Ml1600	-	All	All	All
Operating System	Ge	Multilink Ml1600 Firmware	All	All	All	All
Hardware	Ge	Multilink Ml2400	-	All	All	All
Operating System	Ge	Multilink Ml2400 Firmware	All	All	All	All
Hardware	Ge	Multilink Ml3000	All	All	All	All
Operating System	Ge	Multilink Ml3000 Firmware	All	All	All	All
Hardware	Ge	Multilink Ml3100	All	All	All	All
Operating System	Ge	Multilink Ml3100 Firmware	All	All	All	All
Hardware	Ge	Multilink Ml800	-	All	All	All
Operating System	Ge	Multilink Ml800 Firmware	All	All	All	All
Hardware	Ge	Multilink Ml810	-	All	All	All
Operating System	Ge	Multilink Ml810 Firmware	All	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	GE	Multilink ML800/1200/1600/2400	affected 4.2.1 custom	Not specified
CNA	GE	ML810/3000/3100 Series Switch	affected 5.2.0 custom	Not specified

References

Reference	Source	Link	Tags
www.gedigitalenergy.com/products/support/multilink/MLSB1214.pdf	af854a3a-2127-422b-91ae-364da2661108	www.gedigitalenergy.com	Vendor Advisory
github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-01...	[email protected]	github.com
GE Multilink Switch Vulnerabilities \| ICS-CERT	af854a3a-2127-422b-91ae-364da2661108	ics-cert.us-cert.gov	Third Party Advisory, US Government Resource
www.cisa.gov/news-events/ics-advisories/icsa-15-013-04a	[email protected]	www.cisa.gov
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: Eireann Leverett of IOActive (en)

Additional Advisory Data

Solutions

CNA: GE recommends users update switch firmware to the latest published version to resolve these vulnerabilities. The new firmware will enable new keys to be calculated and exchanged, resolve the slow data transfer and potential denial of service, and prevent the identified cross-site scripting vulnerabilities. The latest firmware is Version 5.3.2 for the ML800, ML1200, ML1600 and ML2400 and Version 5.3.2-3K for the ML810, ML3000, and ML3100. This firmware is available through the “Resources/Software” link in the product web sites at http://www.gedigitalenergy.com . This firmware is also available through the EnerVista Launchpad device management tool. GE recommends updating the switch over a serial connection to prevent an attacker from capturing the new key. Please refer to the GE advisory for specific information on how to install the firmware and change RSA key. The GE advisory is available at: https://www.gedigitalenergy.com/products/support/multilink/MLSB0415.pdf

Legacy QID Mappings

591284 General Electric Multilink Switch Rivest Shamir Adleman (RSA) Private Key and Denial of Service (DoS) Multiple Vulnerabilities (ICSA-15-013-04A)