QID 591284

Date Published: 2023-01-13

QID 591284: General Electric Multilink Switch Rivest Shamir Adleman (RSA) Private Key and Denial of Service (DoS) Multiple Vulnerabilities (ICSA-15-013-04A)

AFFECTED PRODUCTS
GE Multilink ML800/1200/1600/2400 Version 4.2.1and prior.
GE Multilink ML810/3000/3100 series switch Version 5.2.0 and prior.

QID Detection Logic:
This QID checks for the Vulnerable version of General Electric Multilink Switch using passive scanning

The GE Multilink ML800 is subject to unauthorized access via hard-coded credentials. In addition, availability can be impacted through attacks composed of specifically crafted packets to the web server resulting in switch performance degradation. If attacks continue, the web server will be subject to a denial of service. The cross-site scripting vulnerability could inject content into response pages from the web interface, allowing a malicious user to deliver unknown and potentially malicious scripts to other users of the web interface.

CVSS V3 rated as Medium - 5.4 severity.

CVSS V2 rated as Medium - 5 severity.

Solution

Customers are advised to refer to CERT MITIGATIONS section ICSA-15-013-04A for affected packages and patching details.

Vendor References

ICSA-15-013-04A - www.cisa.gov/uscert/ics/advisories/ICSA-15-013-04A

CVEs related to QID 591284

CVE-2014-5418 | CVE-2014-5419 | CVE-2015-3976 |

Software Advisories

Advisory ID	Software	Component	Link
ICSA-15-013-04A			www.cisa.gov/uscert/ics/advisories/ICSA-15-013-04A

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].