Vulnerability-Lookup

CVE-2025-27253 (GCVE-0-2025-27253)

Vulnerability from cvelistv5 – Published: 2025-03-10 09:04 – Updated: 2025-10-07 14:16

Summary

A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to bypass firewall rules or to send malicious traffic in the network.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

CWE

CWE-15 - External Control of System or Configuration Setting

Assigner

Nozomi

References

2 references

URL	Tags
https://www.gevernova.com/grid-solutions/app/Down…
https://www.nozominetworks.com/labs/vulnerability…

Impacted products

20 products

Vendor	Product	Version
GE Vernova	N60 multilin	Affected: 7.0 , ≤ 8.60 (custom)
GE Vernova	B30 Multilin	Affected: 7.0 , ≤ 8.60 (custom)
GE Vernova	B90 Multilin	Affected: 7.0 , ≤ 8.60 (custom)
GE Vernova	C30 Multilin	Affected: 7.0 , ≤ 8.60 (custom)
GE Vernova	C60 Multilin	Affected: 7.0 , ≤ 8.60 (custom)
GE Vernova	C70 Multilin	Affected: 7.0 , ≤ 8.60 (custom)
GE Vernova	C95 Multilin	Affected: 7.0 , ≤ 8.60 (custom)
GE Vernova	D30 Multilin	Affected: 7.0 , ≤ 8.60 (custom)
GE Vernova	D60 Multilin	Affected: 7.0 , ≤ 8.60 (custom)
GE Vernova	F35 Multilin	Affected: 7.0 , ≤ 8.60 (custom)
GE Vernova	F60 Multilin	Affected: 7.0 , ≤ 8.60 (custom)
GE Vernova	G30 Multilin	Affected: 7.0 , ≤ 8.60 (custom)
GE Vernova	G60 Multilin	Affected: 7.0 , ≤ 8.60 (custom)
GE Vernova	L30 Multilin	Affected: 7.0 , ≤ 8.60 (custom)
GE Vernova	L60 Multilin	Affected: 7.0 , ≤ 8.60 (custom)
GE Vernova	L90 Multilin	Affected: 7.0 , ≤ 8.60 (custom)
GE Vernova	M60 Multilin	Affected: 7.0 , ≤ 8.60 (custom)
GE Vernova	T35 Multilin	Affected: 7.0 , ≤ 8.60 (custom)
GE Vernova	T60 Multilin	Affected: 7.0 , ≤ 8.60 (custom)
GE Vernova	M60 Multilin	Affected: 7.0 , ≤ 8.60 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-27253",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-10T15:33:39.489617Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-10T15:33:49.185Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "N60 multilin",
          "vendor": "GE Vernova",
          "versions": [
            {
              "lessThanOrEqual": "8.60",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "B30 Multilin",
          "vendor": "GE Vernova",
          "versions": [
            {
              "lessThanOrEqual": "8.60",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "B90 Multilin",
          "vendor": "GE Vernova",
          "versions": [
            {
              "lessThanOrEqual": "8.60",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "C30 Multilin",
          "vendor": "GE Vernova",
          "versions": [
            {
              "lessThanOrEqual": "8.60",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "C60 Multilin",
          "vendor": "GE Vernova",
          "versions": [
            {
              "lessThanOrEqual": "8.60",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "C70 Multilin",
          "vendor": "GE Vernova",
          "versions": [
            {
              "lessThanOrEqual": "8.60",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "C95 Multilin",
          "vendor": "GE Vernova",
          "versions": [
            {
              "lessThanOrEqual": "8.60",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "D30 Multilin",
          "vendor": "GE Vernova",
          "versions": [
            {
              "lessThanOrEqual": "8.60",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "D60 Multilin",
          "vendor": "GE Vernova",
          "versions": [
            {
              "lessThanOrEqual": "8.60",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "F35 Multilin",
          "vendor": "GE Vernova",
          "versions": [
            {
              "lessThanOrEqual": "8.60",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "F60 Multilin",
          "vendor": "GE Vernova",
          "versions": [
            {
              "lessThanOrEqual": "8.60",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "G30 Multilin",
          "vendor": "GE Vernova",
          "versions": [
            {
              "lessThanOrEqual": "8.60",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "G60 Multilin",
          "vendor": "GE Vernova",
          "versions": [
            {
              "lessThanOrEqual": "8.60",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "L30 Multilin",
          "vendor": "GE Vernova",
          "versions": [
            {
              "lessThanOrEqual": "8.60",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "L60 Multilin",
          "vendor": "GE Vernova",
          "versions": [
            {
              "lessThanOrEqual": "8.60",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "L90 Multilin",
          "vendor": "GE Vernova",
          "versions": [
            {
              "lessThanOrEqual": "8.60",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "M60 Multilin",
          "vendor": "GE Vernova",
          "versions": [
            {
              "lessThanOrEqual": "8.60",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "T35 Multilin",
          "vendor": "GE Vernova",
          "versions": [
            {
              "lessThanOrEqual": "8.60",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "T60 Multilin",
          "vendor": "GE Vernova",
          "versions": [
            {
              "lessThanOrEqual": "8.60",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "M60 Multilin",
          "vendor": "GE Vernova",
          "versions": [
            {
              "lessThanOrEqual": "8.60",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A\u0026nbsp;CWE-15 \"External Control of System or Configuration Setting\"\u0026nbsp;in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to bypass firewall rules or to send malicious traffic in the network."
            }
          ],
          "value": "A\u00a0CWE-15 \"External Control of System or Configuration Setting\"\u00a0in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to bypass firewall rules or to send malicious traffic in the network."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-15",
              "description": "CWE-15 External Control of System or Configuration Setting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-07T14:16:49.710Z",
        "orgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c",
        "shortName": "Nozomi"
      },
      "references": [
        {
          "url": "https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily\u0026type=21\u0026file=76"
        },
        {
          "url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27253"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c",
    "assignerShortName": "Nozomi",
    "cveId": "CVE-2025-27253",
    "datePublished": "2025-03-10T09:04:34.413Z",
    "dateReserved": "2025-02-21T08:32:26.973Z",
    "dateUpdated": "2025-10-07T14:16:49.710Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-27253",
      "date": "2026-05-27",
      "epss": "9e-05",
      "percentile": "0.0096"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-27253\",\"sourceIdentifier\":\"prodsec@nozominetworks.com\",\"published\":\"2025-03-10T09:15:10.897\",\"lastModified\":\"2025-10-07T15:16:02.243\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A\u00a0CWE-15 \\\"External Control of System or Configuration Setting\\\"\u00a0in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to bypass firewall rules or to send malicious traffic in the network.\"},{\"lang\":\"es\",\"value\":\"Una validaci\u00f3n de entrada incorrecta en los dispositivos de la familia GE Vernova UR IED de la versi\u00f3n 7.0 a la 8.60 permite a un atacante proporcionar una entrada que establezca una conexi\u00f3n TCP a trav\u00e9s de un reenv\u00edo de puerto. La falta de validaci\u00f3n de la direcci\u00f3n IP y del puerto puede permitir al atacante eludir las reglas del firewall o enviar tr\u00e1fico malicioso en la red.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"prodsec@nozominetworks.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"prodsec@nozominetworks.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-15\"}]}],\"references\":[{\"url\":\"https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily\u0026type=21\u0026file=76\",\"source\":\"prodsec@nozominetworks.com\"},{\"url\":\"https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27253\",\"source\":\"prodsec@nozominetworks.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-27253\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-10T15:33:39.489617Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-10T15:33:45.461Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"capecId\": \"CAPEC-1\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.1, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"GE Vernova\", \"product\": \"N60 multilin\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"8.60\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"GE Vernova\", \"product\": \"B30 Multilin\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"8.60\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"GE Vernova\", \"product\": \"B90 Multilin\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"8.60\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"GE Vernova\", \"product\": \"C30 Multilin\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"8.60\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"GE Vernova\", \"product\": \"C60 Multilin\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"8.60\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"GE Vernova\", \"product\": \"C70 Multilin\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"8.60\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"GE Vernova\", \"product\": \"C95 Multilin\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"8.60\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"GE Vernova\", \"product\": \"D30 Multilin\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"8.60\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"GE Vernova\", \"product\": \"D60 Multilin\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"8.60\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"GE Vernova\", \"product\": \"F35 Multilin\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"8.60\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"GE Vernova\", \"product\": \"F60 Multilin\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"8.60\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"GE Vernova\", \"product\": \"G30 Multilin\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"8.60\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"GE Vernova\", \"product\": \"G60 Multilin\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"8.60\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"GE Vernova\", \"product\": \"L30 Multilin\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"8.60\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"GE Vernova\", \"product\": \"L60 Multilin\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"8.60\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"GE Vernova\", \"product\": \"L90 Multilin\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"8.60\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"GE Vernova\", \"product\": \"M60 Multilin\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"8.60\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"GE Vernova\", \"product\": \"T35 Multilin\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"8.60\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"GE Vernova\", \"product\": \"T60 Multilin\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"8.60\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"GE Vernova\", \"product\": \"M60 Multilin\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"8.60\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily\u0026type=21\u0026file=76\"}, {\"url\": \"https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27253\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A\\u00a0CWE-15 \\\"External Control of System or Configuration Setting\\\"\\u00a0in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to bypass firewall rules or to send malicious traffic in the network.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"A\u0026nbsp;CWE-15 \\\"External Control of System or Configuration Setting\\\"\u0026nbsp;in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to bypass firewall rules or to send malicious traffic in the network.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-15\", \"description\": \"CWE-15 External Control of System or Configuration Setting\"}]}], \"providerMetadata\": {\"orgId\": \"bec8025f-a851-46e5-b3a3-058e6b0aa23c\", \"shortName\": \"Nozomi\", \"dateUpdated\": \"2025-10-07T14:16:49.710Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-27253\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-07T14:16:49.710Z\", \"dateReserved\": \"2025-02-21T08:32:26.973Z\", \"assignerOrgId\": \"bec8025f-a851-46e5-b3a3-058e6b0aa23c\", \"datePublished\": \"2025-03-10T09:04:34.413Z\", \"assignerShortName\": \"Nozomi\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

BDU:2025-07184

Vulnerability from fstec - Published: 10.03.2025

Title

Уязвимость электронных устройств GE Vernova Intelligent Electronic Device (IED) серии Universal Relay (UR), связанная с недостаточной проверкой входных данных, позволяющая нарушителю обойти существующие ограничения безопасности

Description

Уязвимость электронных устройств GE Vernova Intelligent Electronic Device (IED) серии Universal Relay (UR) связана с недостаточной проверкой входных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, обойти существующие ограничения безопасности

Severity


                    
                      AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

Vendor

GE Vernova

Software Name

GE Vernova UR IED

Software Version

от 7.0 до 8.60 (GE Vernova UR IED)

Possible Mitigations

Использование рекомендаций: https://www.gevernova.com/grid-solutions/passport/login.aspx?ReturnUrl=%2fgrid-solutions%2fapp%2fDownloadFile.aspx%3fprod%3durfamily%26type%3d21%26file%3d76

Reference

https://www.gevernova.com/grid-solutions/passport/login.aspx?ReturnUrl=%2fgrid-solutions%2fapp%2fDownloadFile.aspx%3fprod%3durfamily%26type%3d21%26file%3d76 https://vulners.com/cve/CVE-2025-27253

CWE

CWE-20

JSON

To clipboard

{
  "CVSS 2.0": "AV:A/AC:L/Au:N/C:P/I:N/A:P",
  "CVSS 3.0": "AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "GE Vernova",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u043e\u0442 7.0 \u0434\u043e 8.60 (GE Vernova UR IED)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://www.gevernova.com/grid-solutions/passport/login.aspx?ReturnUrl=%2fgrid-solutions%2fapp%2fDownloadFile.aspx%3fprod%3durfamily%26type%3d21%26file%3d76",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "10.03.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "23.06.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "23.06.2025",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-07184",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-27253",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "GE Vernova UR IED",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 GE Vernova Intelligent Electronic Device (IED) \u0441\u0435\u0440\u0438\u0438 Universal Relay (UR), \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-20)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 GE Vernova Intelligent Electronic Device (IED) \u0441\u0435\u0440\u0438\u0438 Universal Relay (UR) \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.gevernova.com/grid-solutions/passport/login.aspx?ReturnUrl=%2fgrid-solutions%2fapp%2fDownloadFile.aspx%3fprod%3durfamily%26type%3d21%26file%3d76\nhttps://vulners.com/cve/CVE-2025-27253",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-20",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4,8)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,1)"
}

FKIE_CVE-2025-27253

Vulnerability from fkie_nvd - Published: 2025-03-10 09:15 - Updated: 2026-04-15 00:35

Severity

6.1 (Medium) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

Summary

References

	URL	Tags
	prodsec@nozominetworks.com	https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76
	prodsec@nozominetworks.com	https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27253

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A\u00a0CWE-15 \"External Control of System or Configuration Setting\"\u00a0in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to bypass firewall rules or to send malicious traffic in the network."
    },
    {
      "lang": "es",
      "value": "Una validaci\u00f3n de entrada incorrecta en los dispositivos de la familia GE Vernova UR IED de la versi\u00f3n 7.0 a la 8.60 permite a un atacante proporcionar una entrada que establezca una conexi\u00f3n TCP a trav\u00e9s de un reenv\u00edo de puerto. La falta de validaci\u00f3n de la direcci\u00f3n IP y del puerto puede permitir al atacante eludir las reglas del firewall o enviar tr\u00e1fico malicioso en la red."
    }
  ],
  "id": "CVE-2025-27253",
  "lastModified": "2026-04-15T00:35:42.020",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "prodsec@nozominetworks.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-03-10T09:15:10.897",
  "references": [
    {
      "source": "prodsec@nozominetworks.com",
      "url": "https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily\u0026type=21\u0026file=76"
    },
    {
      "source": "prodsec@nozominetworks.com",
      "url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27253"
    }
  ],
  "sourceIdentifier": "prodsec@nozominetworks.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-15"
        }
      ],
      "source": "prodsec@nozominetworks.com",
      "type": "Secondary"
    }
  ]
}

GHSA-J5VP-Q6VG-25MF

Vulnerability from github – Published: 2025-03-10 09:31 – Updated: 2025-03-12 12:30

Details

An improper input validation in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that enstablishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to bypass firewall rules or to send malicious traffic in the network

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-27253"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-15",
      "CWE-20"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-10T09:15:10Z",
    "severity": "MODERATE"
  },
  "details": "An improper input validation in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that enstablishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to bypass firewall rules or to send malicious traffic in the network",
  "id": "GHSA-j5vp-q6vg-25mf",
  "modified": "2025-03-12T12:30:56Z",
  "published": "2025-03-10T09:31:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27253"
    },
    {
      "type": "WEB",
      "url": "https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily\u0026type=21\u0026file=76"
    },
    {
      "type": "WEB",
      "url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27253"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-27253 (GCVE-0-2025-27253)

BDU:2025-07184

FKIE_CVE-2025-27253

GHSA-J5VP-Q6VG-25MF

Tags

Sightings

Nomenclature