CVE-2022-24120 - Vulnerability Details - OpenCVE

Certain General Electric Renewable Energy products store cleartext credentials in flash memory. This affects iNET and iNET II before 8.3.0.

No CVSS v4.0

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Ge	Inet 900 Inet 900 Firmware Inet Ii 900 Inet Ii 900 Firmware Sd1 Sd1 Firmware Sd2 Sd2 Firmware Sd4 Sd4 Firmware Sd9 Sd9 Firmware Td220max Td220max Firmware Td220x Td220x Firmware

Configuration 1 [-]

AND

cpe:2.3:o:ge:inet_900_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:inet_900:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:ge:inet_ii_900_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:inet_ii_900:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:ge:sd1_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:sd1:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:ge:sd2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:sd2:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:ge:sd4_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:sd4:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:ge:sd9_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:sd9:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:ge:td220max_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:td220max:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:ge:td220x_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ge:td220x:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-06

History

Sat, 12 Apr 2025 00:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-12-26T00:00:00.000Z

Updated: 2025-04-11T23:31:04.226Z

Reserved: 2022-01-28T00:00:00.000Z

Link: CVE-2022-24120

Vulnrichment

Updated: 2024-08-03T03:59:23.734Z

NVD

Status : Modified

Published: 2022-12-26T05:15:11.207

Modified: 2025-04-12T00:15:16.340

Link: CVE-2022-24120

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ge:inet_900_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "053CB7A9-6C3C-4304-816E-929D9214D85D", "versionEndExcluding": "8.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ge:inet_900:-:*:*:*:*:*:*:*", "matchCriteriaId": "B7ED1619-0B7A-47FA-A479-D04B11363773", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ge:inet_ii_900_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D7C18050-4CC7-43BC-86C9-F60143AE66D8", "versionEndExcluding": "8.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ge:inet_ii_900:-:*:*:*:*:*:*:*", "matchCriteriaId": "0490A0F3-D9BA-48DD-9C4C-6397459E93C2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ge:sd1_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "DFB6657B-94C3-428A-8C35-C86C8876AF73", "versionEndIncluding": "6.4.7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ge:sd1:-:*:*:*:*:*:*:*", "matchCriteriaId": "08EFCE64-2DF8-466D-989E-D8509F9DD314", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ge:sd2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "42922AA6-50D7-449A-8C6E-28F0E50BA78F", "versionEndExcluding": "6.4.7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ge:sd2:-:*:*:*:*:*:*:*", "matchCriteriaId": "F4E7CB12-ACEC-4499-A743-57CF20829560", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ge:sd4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "1BF373FE-4A12-4FC9-A758-00CF0DE29783", "versionEndExcluding": "6.4.7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ge:sd4:-:*:*:*:*:*:*:*", "matchCriteriaId": "62A537E3-613C-4211-9ED8-A002B1207A66", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ge:sd9_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "805F40B3-BA5F-4E61-97A0-B22F0D1A0E30", "versionEndExcluding": "6.4.7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ge:sd9:-:*:*:*:*:*:*:*", "matchCriteriaId": "B2D3B5FC-2EE5-477A-AA63-7D4E1085B5EC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ge:td220max_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7D4E50AB-AC03-4A8F-8524-242CAA5C22C1", "versionEndExcluding": "1.2.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ge:td220max:-:*:*:*:*:*:*:*", "matchCriteriaId": "E5C8CC4F-FBB9-45F6-ABE6-23DB061646C1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ge:td220x_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "401DED9A-E36D-4FFA-A4A1-ACD1560B7A89", "versionEndExcluding": "2.0.16", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ge:td220x:-:*:*:*:*:*:*:*", "matchCriteriaId": "352FB5AB-64AA-48DF-90B8-FF738790139D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Certain General Electric Renewable Energy products store cleartext credentials in flash memory. This affects iNET and iNET II before 8.3.0."}, {"lang": "es", "value": "Ciertos productos de General Electric Renewable Energy almacenan credenciales de texto plano en la memoria flash. Esto afecta a iNET e iNET II anteriores a 8.3.0."}], "id": "CVE-2022-24120", "lastModified": "2025-04-12T00:15:16.340", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-12-26T05:15:11.207", "references": [{"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-06"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-06"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-312"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-312"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}