CVE-2022-24119 - Vulnerability Details - OpenCVE

Certain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to the device configuration shell. This affects iNET and iNET II before 8.3.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Ge	Inet 900 Inet 900 Firmware Inet Ii 900 Inet Ii 900 Firmware Sd1 Sd1 Firmware Sd2 Sd2 Firmware Sd4 Sd4 Firmware Sd9 Sd9 Firmware Td220max Td220max Firmware Td220x Td220x Firmware

Configuration 1 [-]

AND

cpe:2.3:o:ge:inet_900_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:inet_900:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:ge:inet_ii_900_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:inet_ii_900:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:ge:sd1_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:sd1:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:ge:sd2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:sd2:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:ge:sd4_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:sd4:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:ge:sd9_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:sd9:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:ge:td220max_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:td220max:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:ge:td220x_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:td220x:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-06

History

Sat, 12 Apr 2025 00:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-12-26T00:00:00.000Z

Updated: 2025-04-11T23:41:26.428Z

Reserved: 2022-01-28T00:00:00.000Z

Link: CVE-2022-24119

Vulnrichment

Updated: 2024-08-03T03:59:23.921Z

NVD

Status : Modified

Published: 2022-12-26T05:15:11.147

Modified: 2025-04-12T00:15:16.180

Link: CVE-2022-24119

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ge:inet_900_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "053CB7A9-6C3C-4304-816E-929D9214D85D", "versionEndExcluding": "8.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ge:inet_900:-:*:*:*:*:*:*:*", "matchCriteriaId": "B7ED1619-0B7A-47FA-A479-D04B11363773", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ge:inet_ii_900_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D7C18050-4CC7-43BC-86C9-F60143AE66D8", "versionEndExcluding": "8.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ge:inet_ii_900:-:*:*:*:*:*:*:*", "matchCriteriaId": "0490A0F3-D9BA-48DD-9C4C-6397459E93C2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ge:sd1_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "DFB6657B-94C3-428A-8C35-C86C8876AF73", "versionEndIncluding": "6.4.7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ge:sd1:-:*:*:*:*:*:*:*", "matchCriteriaId": "08EFCE64-2DF8-466D-989E-D8509F9DD314", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ge:sd2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "42922AA6-50D7-449A-8C6E-28F0E50BA78F", "versionEndExcluding": "6.4.7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ge:sd2:-:*:*:*:*:*:*:*", "matchCriteriaId": "F4E7CB12-ACEC-4499-A743-57CF20829560", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ge:sd4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "1BF373FE-4A12-4FC9-A758-00CF0DE29783", "versionEndExcluding": "6.4.7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ge:sd4:-:*:*:*:*:*:*:*", "matchCriteriaId": "62A537E3-613C-4211-9ED8-A002B1207A66", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ge:sd9_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "805F40B3-BA5F-4E61-97A0-B22F0D1A0E30", "versionEndExcluding": "6.4.7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ge:sd9:-:*:*:*:*:*:*:*", "matchCriteriaId": "B2D3B5FC-2EE5-477A-AA63-7D4E1085B5EC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ge:td220max_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7D4E50AB-AC03-4A8F-8524-242CAA5C22C1", "versionEndExcluding": "1.2.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ge:td220max:-:*:*:*:*:*:*:*", "matchCriteriaId": "E5C8CC4F-FBB9-45F6-ABE6-23DB061646C1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ge:td220x_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "401DED9A-E36D-4FFA-A4A1-ACD1560B7A89", "versionEndExcluding": "2.0.16", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ge:td220x:-:*:*:*:*:*:*:*", "matchCriteriaId": "352FB5AB-64AA-48DF-90B8-FF738790139D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Certain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to the device configuration shell. This affects iNET and iNET II before 8.3.0."}, {"lang": "es", "value": "Ciertos productos de General Electric Renewable Energy tienen una funci\u00f3n oculta para el acceso remoto no autenticado al shell de configuraci\u00f3n del dispositivo. Esto afecta a iNET e iNET II anteriores a 8.3.0."}], "id": "CVE-2022-24119", "lastModified": "2025-04-12T00:15:16.180", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-12-26T05:15:11.147", "references": [{"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-06"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-06"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-829"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-829"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}