GE Hydran M2 CVE-2014-5409 Predictable TCP Initial Sequence Number Vulnerability

Key Information Vulnerability Name: GE Hydran M2 Predictable TCP Initial Sequence Vulnerability Revision Date: August 27, 2018 Alert Code: ICSA-15-041-02 Overview: - This vulnerability was first published on February 10, 2015, in the US-CERT Security Portal Library, and was released to the NCCIC/ICS-CERT website on August 27, 2018. - The research project, partially funded by the Georgia Institute of Technology’s National Electric Energy Testing Research and Applications Center, identified a predictable TCP sequence vulnerability in GE Digital Energy’s Hydran M2 device. Affected Products: - Hydran M2, including the 17046 Ethernet option, products released before October 2014. Impact: - Successful exploitation of this vulnerability could allow manipulation or spoofing of TCP connections, potentially leading to denial-of-service (DoS) conditions or transmission of inaccurate data regarding developing transformer fault conditions. - The impact on each organization depends on various factors; ICS-CERT recommends organizations assess the impact based on their operational environment, architecture, and product implementation. Background: - GE Digital Energy is a U.S.-based company with offices in multiple countries worldwide. - Hydran M2 is an online transformer monitoring device produced by GE Digital Energy, primarily used in the energy industry. Vulnerability Characteristics: - Predictable Value Range: CWE-343: Predictable value range derived from previous values. - Impact: The vulnerability may enable TCP sequence attacks, allowing attackers to forge TCP initial sequence numbers and send malicious packets. - CVE ID: CVE-2014-5409NVD, CVSS v2 Base Score: 6.4. Vulnerability Details: - Exploitability: Remotely exploitable. - Known Exploitation Tools: No specific publicly available exploitation tools targeting this vulnerability are known. - Difficulty: Low-skilled attackers can exploit this vulnerability. Mitigation Measures: - GE Digital Energy released a new version of the Ethernet option that resolves the identified vulnerability. - Implement secure network operations and devices to limit network exposure. - Use secure remote access methods, such as VPNs. Vendor: GE

Goal Reached Thanks to every supporter — we hit 100%!

GE Hydran M2 CVE-2014-5409 Predictable TCP Initial Sequence Number Vulnerability

More from this source