by Kastro
Paper/Archive/CVE-2020-25197

CVE-2020-25197

GE Reason RT43X Clocks — GE Reason RT43X Clocks Code Injection

EPSS 3%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 88.0.880 × 2017.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A code injection vulnerability exists in one of the webpages in GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06 that could allow an authenticated remote attacker to execute arbitrary code on the system.

Affected

ProductAffectedFixed inSource
Reason RT43X Clocksunspecified – < 08A0608A06CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-21-005-03refgegridsolutions.com/app/DownloadFile.aspx?prod=RT430&type=21&file=5