Back to Database
Status published
High
CVE-2021-27422
GE UR family exposure of sensitive information to an unauthorized actor
Vulnerability Description
GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol. It allows sensitive information exposure without authentication.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-27422
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- SCADA-X, DOE’s Cyber Testing for Resilient Industrial Control Systems (CyTRICS) program, Verve Industrial, and VuMetric reported these vulnerabilities to GE.
References
More from GE
View All →CVE-2022-3092
GE CIMPLICITY Out-of-bounds Write
High
7.8
CVE-2022-3084
GE CIMPLICITY Access of Uninitialized Pointer
High
7.8
CVE-2022-2952
GE CIMPLICITY Access of Uninitialized Pointer
High
7.8
CVE-2022-2948
GE CIMPLICITY Heap-based Buffer Overflow
High
7.8
CVE-2022-2002
GE CIMPLICITY Untrusted Pointer Dereference
High
7.8
Affected Vendor
Affected Software
UR family
Vulnerable Versions:
unspecified
Timeline
Official Publish:
March 23rd, 2022
Last Modified:
April 16th, 2025
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N