GE Reason DR60 Hardcoded Password & Code Injection Vulnerabilities (CVE-2021-27440/27438)

Vulnerability Key Information 1. Executive Summary CVSS v3: 9.8 Note: Remote exploitation / Low skill level required Vendor: GE Device: Reason DR60 Vulnerabilities: - Hardcoded password (CVE-2021-27440) - Code injection (CVE-2021-27438) - Execution with unnecessary privileges (CVE-2021-27454) 2. Risk Assessment Successful exploitation of these vulnerabilities could allow an attacker to fully compromise the digital fault recorder (DFR), execute code remotely, or escalate privileges. 3. Technical Details Affected Products: All firmware versions of Reason DR60 prior to 02A04.1 Vulnerability Overview: - Hardcoded Password (CWE-259): - The software contains a hardcoded password used for its own authentication or communication with external components. - CVE-2021-27440 has been assigned to this vulnerability, with a CVSS v3 base score of 9.8. - Code Injection (CWE-94): - The software uses externally-influenced input to construct code segments, but fails to neutralize or improperly neutralizes special elements that could alter code syntax or behavior. - CVE-2021-27438 has been assigned to this vulnerability, with a CVSS v3 base score of 8.8. - Execution with Unnecessary Privileges (CWE-250): - The software performs operations at a privilege level higher than the minimum required, introducing new vulnerabilities or amplifying the impact of other vulnerabilities. - CVE-2021-27454 has been assigned to this vulnerability, with a CVSS v3 base score of 7.8. 3. Background Critical Infrastructure Sectors: Communications, Critical Manufacturing, Energy, Healthcare and Public Health, Transportation Systems, Water and Wastewater Systems Deployment Countries/Regions: Worldwide Company Headquarters Location: United States 4. Mitigation Measures Vendor Recommendation: Upgrade to firmware version 02A04.1 or later. Other Recommended Measures: - Minimize exposure of all control system devices and/or networks, and ensure they are not directly accessible from the internet. - Place control system networks and remote devices behind firewalls and isolate them from enterprise networks. - Use secure methods such as Virtual Private Networks (VPNs) for remote access, and ensure they are properly updated. Additional Information Researchers: Thales OT Security Team reported these vulnerabilities to GE. This information is considered archived content and may no longer reflect current policies or procedures on CISA.gov.

Goal Reached Thanks to every supporter — we hit 100%!

GE Reason DR60 Hardcoded Password & Code Injection Vulnerabilities (CVE-2021-27440/27438)