Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-7905

A Weak Cryptography for Passwords issue was discovered in General Electric (GE) Multilin SR 750 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 760 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 469 Motor Protection Relay, firmware versions prior to Version 5.23; SR 489 Generator Protection Relay, firmware versions prior to Version 4.06; SR 745 Transformer Protection Relay, firmware versions prior to Version 5.23; SR 369 Motor Protection Relay, all firmware versions; Multilin Universal Relay, firmware Version 6.0 and prior versions; and Multilin URplus (D90, C90, B95), all versions. Ciphertext versions of user passwords were created with a non-random initialization vector leaving them susceptible to dictionary attacks. Ciphertext of user passwords can be obtained from the front LCD panel of affected products and through issued Modbus commands.

Security Impact Summary

This vulnerability carries a CRITICAL severity rating with a CVSS v3.1 score of 9.8, indicating it can be exploited remotely over the network with relatively low complexity without requiring user interaction and does not require pre-existing privileges . The vulnerability impacts confidentiality (data exposure), integrity (unauthorized modifications), and availability (service disruption) for affected systems. Impacting 20 products from ge, from ge, from ge and 17 others, organizations running these solutions should prioritize assessment and patching.

Historical Context

First disclosed in 2017, this vulnerability was reported during a period defined by widespread IoT adoption challenges, mobile security concerns, and the emergence of advanced persistent threat (APT) techniques. Contemporary mitigation strategies focused on secure development practices and third-party component vetting.

Published

2017-06-30T03:29:00.890

Last Modified

2025-04-20T01:37:25.860

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-261
  • Type: Primary
    CWE-326
    CWE-330
    CWE-522
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System ge multilin_sr_750_feeder_protection_relay_firmware ≤ 5.02 Yes
Hardware ge multilin_sr_750_feeder_protection_relay - No
Operating System ge multilin_sr_760_feeder_protection_relay_firmware ≤ 5.02 Yes
Hardware ge multilin_sr_760_feeder_protection_relay - No
Operating System ge multilin_sr_469_motor_protection_relay_firmware ≤ 2.90 Yes
Hardware ge multilin_sr_469_motor_protection_relay - No
Operating System ge multilin_sr_489_generator_protection_relay_firmware ≤ 1.53 Yes
Hardware ge multilin_sr_489_generator_protection_relay - No
Operating System ge multilin_sr_745_transformer_protection_relay_firmware ≤ 2.85 Yes
Hardware ge multilin_sr_745_transformer_protection_relay - No
Operating System ge multilin_sr_369_motor_protection_relay_firmware - Yes
Hardware ge multilin_sr_369_motor_protection_relay - No
Operating System ge multilin_universal_relay_firmware ≤ 6.0 Yes
Hardware ge multilin_universal_relay - No
Operating System ge multilin_urplus_d90_firmware - Yes
Hardware ge multilin_urplus_d90 - No
Operating System ge multilin_urplus_c90_firmware - Yes
Hardware ge multilin_urplus_c90 - No
Operating System ge multilin_urplus_b95_firmware - Yes
Hardware ge multilin_urplus_b95 - No
References

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For ge's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.