CVE-2020-12017

{"containers": {"cna": {"affected": [{"product": "GE Grid Solutions Reason RT Clocks", "vendor": "n/a", "versions": [{"status": "affected", "version": "RT430, RT431, and RT434, all firmware versions prior to 08A05"}]}], "descriptions": [{"lang": "en", "value": "GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device\u2019s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute arbitrary commands and send a request to a specific URL that could cause the device to become unresponsive. The unauthenticated attacker may change the password of the 'configuration' user account, allowing the attacker to modify the configuration of the device via the web interface using the new password. This vulnerability may also allow an unauthenticated attacker to bypass the authentication required to configure the device and reboot the system."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-06-02T18:31:05.000Z", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.us-cert.gov/ics/advisories/icsa-20-154-05"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "ID": "CVE-2020-12017", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "GE Grid Solutions Reason RT Clocks", "version": {"version_data": [{"version_value": "RT430, RT431, and RT434, all firmware versions prior to 08A05"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device\u2019s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute arbitrary commands and send a request to a specific URL that could cause the device to become unresponsive. The unauthenticated attacker may change the password of the 'configuration' user account, allowing the attacker to modify the configuration of the device via the web interface using the new password. This vulnerability may also allow an unauthenticated attacker to bypass the authentication required to configure the device and reboot the system."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306"}]}]}, "references": {"reference_data": [{"name": "https://www.us-cert.gov/ics/advisories/icsa-20-154-05", "refsource": "MISC", "url": "https://www.us-cert.gov/ics/advisories/icsa-20-154-05"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T11:48:58.016Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.us-cert.gov/ics/advisories/icsa-20-154-05"}]}]}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2020-12017", "datePublished": "2020-06-02T18:31:05.000Z", "dateReserved": "2020-04-21T00:00:00.000Z", "dateUpdated": "2024-08-04T11:48:58.016Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "GE Grid Solutions Reason RT Clocks", "vendor": "n/a", "versions": [{"status": "affected", "version": "RT430, RT431, and RT434, all firmware versions prior to 08A05"}]}], "source": "ics-cert@hq.dhs.gov"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ge:rt430_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "DD109DE7-1C72-4778-9B9E-268F2E731018", "versionEndExcluding": "08a05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ge:rt430:-:*:*:*:*:*:*:*", "matchCriteriaId": "0EB994D8-B52E-4375-8957-6B5F0866F5B3", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ge:rt431_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C32D1CAD-1546-4229-AC62-80E5A2E7557C", "versionEndExcluding": "08a05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ge:rt431:-:*:*:*:*:*:*:*", "matchCriteriaId": "366B4D1B-A8CB-4EA9-8C84-A4E3CCB4B22D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ge:rt434_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "10BC5948-A2D1-45B6-87B4-DD4524791F18", "versionEndExcluding": "08a05", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ge:rt434:-:*:*:*:*:*:*:*", "matchCriteriaId": "BCD38027-CE2E-45B0-98B2-922C64494745", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device\u2019s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute arbitrary commands and send a request to a specific URL that could cause the device to become unresponsive. The unauthenticated attacker may change the password of the 'configuration' user account, allowing the attacker to modify the configuration of the device via the web interface using the new password. This vulnerability may also allow an unauthenticated attacker to bypass the authentication required to configure the device and reboot the system."}, {"lang": "es", "value": "GE Grid Solutions Reason RT Clocks, RT430, RT431 y RT434, todas las versiones de firmware anteriores a 08A05. La vulnerabilidad del dispositivo en la aplicaci\u00f3n web podr\u00eda permitir m\u00faltiples ataques no autenticados que podr\u00edan causar un grave impacto. La vulnerabilidad puede permitir a un atacante no autenticado ejecutar comandos arbitrarios y enviar una petici\u00f3n hacia una URL espec\u00edfica que podr\u00eda causar que el dispositivo deje de responder. El atacante no autenticado puede cambiar la contrase\u00f1a de la cuenta de usuario \"configuration\", permitiendo al atacante modificar la configuraci\u00f3n del dispositivo por medio de la interfaz web usando la nueva contrase\u00f1a. Esta vulnerabilidad tambi\u00e9n puede permitir a un atacante no autenticado omitir la autenticaci\u00f3n requerida para configurar el dispositivo y reiniciar el sistema."}], "id": "CVE-2020-12017", "lastModified": "2026-06-17T02:51:15.693", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 8.5, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-06-02T19:15:11.403", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.us-cert.gov/ics/advisories/icsa-20-154-05"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.us-cert.gov/ics/advisories/icsa-20-154-05"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-306"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}