CVE-2021-31477 - CVE House

Back to Database

Status published Medium CVE-2021-31477

This vulnerability allows remote attackers to execute arbitrary code on...

6.3 CVSS

Vulnerability Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware and filesystem of the device. The firmware and filesystem contain hard-coded default credentials. An attacker can leverage this vulnerability to execute code in the context of the download user. Was ZDI-CAN-11852.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-31477

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Anonymous

References

More from GE

View All →

GE CIMPLICITY Out-of-bounds Write

GE CIMPLICITY Access of Uninitialized Pointer

GE CIMPLICITY Access of Uninitialized Pointer

GE CIMPLICITY Heap-based Buffer Overflow

GE CIMPLICITY Untrusted Pointer Dereference

Affected Vendor

GE

View all reports →

Affected Software

Reason RPV311

Vulnerable Versions:

14A03

Timeline

Official Publish: June 16th, 2021

Last Modified: August 3rd, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1552 Unsecured Credentials

Credential Access

T1078 Valid Accounts

T1021 Remote Services

Lateral Movement

T1190 Exploit Public-Facing Application

T1098 Account Manipulation

Privilege Escalation