Vulnerability-Lookup

GHSA-Q58V-2VRW-X3XH

Vulnerability from github – Published: 2022-03-19 00:00 – Updated: 2022-03-29 00:01

Details

By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06, attackers would be able to intercept and decrypt encrypted traffic through an HTTPS connection.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-25193"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-798"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-03-18T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 \u0026 RT434 GNSS clocks in firmware versions prior to version 08A06, attackers would be able to intercept and decrypt encrypted traffic through an HTTPS connection.",
  "id": "GHSA-q58v-2vrw-x3xh",
  "modified": "2022-03-29T00:01:36Z",
  "published": "2022-03-19T00:00:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25193"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03"
    },
    {
      "type": "WEB",
      "url": "https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430\u0026type=21\u0026file=5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2020-25193 (GCVE-0-2020-25193)

Vulnerability from cvelistv5 – Published: 2022-03-18 18:00 – Updated: 2025-04-16 16:41

Title

GE Reason RT43X Clocks Use of Hard-coded Cryptographic Key

Summary

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-321 - Use of Hard-coded Cryptographic Key

Assigner

icscert

References

2 references

URL	Tags
https://www.cisa.gov/uscert/ics/advisories/icsa-2…	x_refsource_CONFIRM
https://www.gegridsolutions.com/app/DownloadFile.…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
GE	Reason RT43X Clocks	Affected: unspecified , < 08A06 (custom)

Credits

Tom Westenberg of Thales UK reported these vulnerabilities to GE.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:26:10.063Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430\u0026type=21\u0026file=5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-25193",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-16T15:59:19.792538Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-16T16:41:25.123Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Reason RT43X Clocks",
          "vendor": "GE",
          "versions": [
            {
              "lessThan": "08A06",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Tom Westenberg of Thales UK reported these vulnerabilities to GE."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 \u0026 RT434 GNSS clocks in firmware versions prior to version 08A06, attackers would be able to intercept and decrypt encrypted traffic through an HTTPS connection."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-321",
              "description": "CWE-321 Use of Hard-coded Cryptographic Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-18T18:00:35.000Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430\u0026type=21\u0026file=5"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "GE strongly recommends users of Reason RT43X products update their units to firmware Version 08A06 or greater to resolve these issues. The firmware update addresses both vulnerabilities as described in the Reason RT43X 08A06 Release Notes.\n\nPlease see GE publication GES-2020-006 (login required) for more details on these issues."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "GE Reason RT43X Clocks Use of Hard-coded Cryptographic Key",
      "workarounds": [
        {
          "lang": "en",
          "value": "GE recommends users evaluate current risk and implement appropriate network security mitigation measures as follows. The following mitigation actions do not ensure complete security but should be considered until the affected time synchronization product is upgraded:\n    Use strong network and physical security protection to prevent an attacker from reaching the local network where Reason RT43X clocks are normally installed. \n    Block TCP/IP Ports 80 and 443 to block the HTTP/HTTPS access to web interface with Reason RT43X products, avoiding all the vulnerabilities. This TCP/IP port blocking should be limited to the Ethernet port interface where the Reason RT43X clock is connected (e.g., using Access Control List (ACL)). Otherwise, other HTTP/HTTPS applications may be affected.\n    Minimize network exposure for all control system devices and/or systems and ensure they are not accessible from the Internet.\n    Analyze security events to early detect unexpected traffic/communication."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2020-25193",
          "STATE": "PUBLIC",
          "TITLE": "GE Reason RT43X Clocks Use of Hard-coded Cryptographic Key"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Reason RT43X Clocks",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "08A06"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "GE"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Tom Westenberg of Thales UK reported these vulnerabilities to GE."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 \u0026 RT434 GNSS clocks in firmware versions prior to version 08A06, attackers would be able to intercept and decrypt encrypted traffic through an HTTPS connection."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-321 Use of Hard-coded Cryptographic Key"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03",
              "refsource": "CONFIRM",
              "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-005-03"
            },
            {
              "name": "https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430\u0026type=21\u0026file=5",
              "refsource": "CONFIRM",
              "url": "https://www.gegridsolutions.com/app/DownloadFile.aspx?prod=RT430\u0026type=21\u0026file=5"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "GE strongly recommends users of Reason RT43X products update their units to firmware Version 08A06 or greater to resolve these issues. The firmware update addresses both vulnerabilities as described in the Reason RT43X 08A06 Release Notes.\n\nPlease see GE publication GES-2020-006 (login required) for more details on these issues."
          }
        ],
        "source": {
          "discovery": "EXTERNAL"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "GE recommends users evaluate current risk and implement appropriate network security mitigation measures as follows. The following mitigation actions do not ensure complete security but should be considered until the affected time synchronization product is upgraded:\n    Use strong network and physical security protection to prevent an attacker from reaching the local network where Reason RT43X clocks are normally installed. \n    Block TCP/IP Ports 80 and 443 to block the HTTP/HTTPS access to web interface with Reason RT43X products, avoiding all the vulnerabilities. This TCP/IP port blocking should be limited to the Ethernet port interface where the Reason RT43X clock is connected (e.g., using Access Control List (ACL)). Otherwise, other HTTP/HTTPS applications may be affected.\n    Minimize network exposure for all control system devices and/or systems and ensure they are not accessible from the Internet.\n    Analyze security events to early detect unexpected traffic/communication."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2020-25193",
    "datePublished": "2022-03-18T18:00:35.000Z",
    "dateReserved": "2020-09-04T00:00:00.000Z",
    "dateUpdated": "2025-04-16T16:41:25.123Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-Q58V-2VRW-X3XH

CVE-2020-25193 (GCVE-0-2020-25193)

Tags

Sightings

Nomenclature