GE Multiple Products CVE-2017-7905 Weak Password Security Vulnerability

Bugtraq ID:	98063
Class:	Design Error
CVE:	CVE-2017-7905
Remote:	Yes
Local:	No
Published:	Apr 27 2017 12:00AM
Updated:	May 02 2017 12:11AM
Credit:	Anastasis Keliris, Charalambos Konstantinou, Marios Sazos, and Dr. Michail (Mihalis) Maniatakos.
Vulnerable:	Ge 760 Feeder Protection Relay 0 Ge 750 Feeder Protection Relay 0 Ge 745 Transformer Protection Relay 0 Ge 489 Generator Protection Relay 0 Ge 469 Motor Protection Relay 0 Ge 369 Motor Protection Relay 0
Not Vulnerable:	Ge 760 Feeder Protection Relay 7.47 Ge 750 Feeder Protection Relay 7.47 Ge 745 Transformer Protection Relay 5.23 Ge 489 Generator Protection Relay 4.06 Ge 469 Motor Protection Relay 5.23

GE Multiple Products CVE-2017-7905 Weak Password Security Vulnerability

GE Multiple Products are prone to a weak password security vulnerability.

Attackers can exploit this issue to gain unauthorized access to the system.

The following products are affected:

GE 750 Feeder Protection Relay prior to 7.47.
GE 760 Feeder Protection Relay prior to 7.47.
GE 469 Motor Protection Relay prior to 5.23.
GE 489 Generator Protection Relay prior to 4.06.
GE 745 Transformer Protection Relay prior to 5.23.
GE 369 Motor Protection Relay.

GE Multiple Products CVE-2017-7905 Weak Password Security Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

GE Multiple Products CVE-2017-7905 Weak Password Security Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

GE Multiple Products CVE-2017-7905 Weak Password Security Vulnerability

References:

• GE Homepage (GE)
  
• ICSA-17-117-01: GE Multilin SR Protective Relays (CERT)