CVE-2022-24120 : Certain General Electric Renewable Energy products store cleartext credentials i

Certain General Electric Renewable Energy products store cleartext credentials in flash memory. This affects iNET and iNET II before 8.3.0.

Published 2022-12-26 05:15:11

Updated 2023-01-05 15:59:45

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2022-24120

GE » Inet 900 Firmware
Versions before (<) 8.3.0
cpe:2.3:o:ge:inet_900_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: GE » Inet 900 » Version: N/A
GE » Inet Ii 900 Firmware
Versions before (<) 8.3.0
cpe:2.3:o:ge:inet_ii_900_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: GE » Inet Ii 900 » Version: N/A
GE » Sd1 Firmware
Versions up to, including, (<=) 6.4.7
cpe:2.3:o:ge:sd1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: GE » SD1 » Version: N/A
GE » Sd2 Firmware
Versions before (<) 6.4.7
cpe:2.3:o:ge:sd2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: GE » SD2 » Version: N/A
GE » Sd4 Firmware
Versions before (<) 6.4.7
cpe:2.3:o:ge:sd4_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: GE » SD4 » Version: N/A
GE » Sd9 Firmware
Versions before (<) 6.4.7
cpe:2.3:o:ge:sd9_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: GE » SD9 » Version: N/A
GE » Td220max Firmware
Versions before (<) 1.2.6
cpe:2.3:o:ge:td220max_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: GE » Td220max » Version: N/A
GE » Td220x Firmware
Versions before (<) 2.0.16
cpe:2.3:o:ge:td220x_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: GE » Td220x » Version: N/A

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 25 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.6	MEDIUM	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	0.9	3.6	NIST
Attack Vector: Physical Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE-312 Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Assigned by: nvd@nist.gov (Primary)

Jump to