CVE-2021-27418 - CVE House
Back to Database
Status published Medium CVE-2021-27418

GE UR family input validation

Vulnerability Description

GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting attacks, which may be used to send a malicious script. Also, UR Firmware web server does not perform HTML encoding of user-supplied strings.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-27418

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • SCADA-X, DOE’s Cyber Testing for Resilient Industrial Control Systems (CyTRICS) program, Verve Industrial, and VuMetric reported these vulnerabilities to GE.

References

More from GE

View All →
CVE-2022-3092
GE CIMPLICITY Out-of-bounds Write
High 7.8
CVE-2022-3084
GE CIMPLICITY Access of Uninitialized Pointer
High 7.8
CVE-2022-2952
GE CIMPLICITY Access of Uninitialized Pointer
High 7.8
CVE-2022-2948
GE CIMPLICITY Heap-based Buffer Overflow
High 7.8
CVE-2022-2002
GE CIMPLICITY Untrusted Pointer Dereference
High 7.8

Affected Vendor

Affected Software

UR family
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 23rd, 2022
Last Modified: April 16th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-20

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact