GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute arbitrary commands and send a request to a specific URL that could cause the device to become unresponsive. The unauthenticated attacker may change the password of the 'configuration' user account, allowing the attacker to modify the configuration of the device via the web interface using the new password. This vulnerability may also allow an unauthenticated attacker to bypass the authentication required to configure the device and reboot the system.
Published 2020-06-02 19:15:11
Updated 2020-06-08 17:53:02
Source ICS-CERT
View at NVD,   CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2020-12017

0.24%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 61 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-12017

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
9.0
HIGH AV:N/AC:L/Au:N/C:P/I:P/A:C
10.0
8.5
NIST
9.8
CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.9
5.9
NIST

CWE ids for CVE-2020-12017

  • The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
    Assigned by:
    • ics-cert@hq.dhs.gov (Secondary)
    • nvd@nist.gov (Primary)

References for CVE-2020-12017

Products affected by CVE-2020-12017

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!