Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-7905

A Weak Cryptography for Passwords issue was discovered in General Electric (GE) Multilin SR 750 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 760 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 469 Motor Protection Relay, firmware versions prior to Version 5.23; SR 489 Generator Protection Relay, firmware versions prior to Version 4.06; SR 745 Transformer Protection Relay, firmware versions prior to Version 5.23; SR 369 Motor Protection Relay, all firmware versions; Multilin Universal Relay, firmware Version 6.0 and prior versions; and Multilin URplus (D90, C90, B95), all versions. Ciphertext versions of user passwords were created with a non-random initialization vector leaving them susceptible to dictionary attacks. Ciphertext of user passwords can be obtained from the front LCD panel of affected products and through issued Modbus commands.

Published

2017-06-30T03:29:00.890

Last Modified

2025-04-20T01:37:25.860

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-261
  • Type: Primary
    CWE-326
    CWE-330
    CWE-522
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System ge multilin_sr_750_feeder_protection_relay_firmware ≤ 5.02 Yes
Hardware ge multilin_sr_750_feeder_protection_relay - No
Operating System ge multilin_sr_760_feeder_protection_relay_firmware ≤ 5.02 Yes
Hardware ge multilin_sr_760_feeder_protection_relay - No
Operating System ge multilin_sr_469_motor_protection_relay_firmware ≤ 2.90 Yes
Hardware ge multilin_sr_469_motor_protection_relay - No
Operating System ge multilin_sr_489_generator_protection_relay_firmware ≤ 1.53 Yes
Hardware ge multilin_sr_489_generator_protection_relay - No
Operating System ge multilin_sr_745_transformer_protection_relay_firmware ≤ 2.85 Yes
Hardware ge multilin_sr_745_transformer_protection_relay - No
Operating System ge multilin_sr_369_motor_protection_relay_firmware - Yes
Hardware ge multilin_sr_369_motor_protection_relay - No
Operating System ge multilin_universal_relay_firmware ≤ 6.0 Yes
Hardware ge multilin_universal_relay - No
Operating System ge multilin_urplus_d90_firmware - Yes
Hardware ge multilin_urplus_d90 - No
Operating System ge multilin_urplus_c90_firmware - Yes
Hardware ge multilin_urplus_c90 - No
Operating System ge multilin_urplus_b95_firmware - Yes
Hardware ge multilin_urplus_b95 - No
References