Vulnerability in Ge Mds Pulsenet

CVE-2015-6456

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 have hardcoded credentials for a support account, which allows remote attackers to obtain administrative access, and consequently execute arbitrary code, by leveraging knowledge of the password.

EPSS: 0.038 (88.9th percentile) — read the EPSS interpretation.

Affected products

Ge Mds_pulsenet
N/a — versions n/a

References

ics-cert@hq.dhs.gov (x_refsource_MISC)
ics-cert@hq.dhs.gov (x_refsource_CONFIRM, Vendor Advisory)
ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC)