What is CVE-2017-7905?

CVE-2017-7905 is a critical-severity vulnerability in Ge Multilin Sr 369 Motor Protection Relay, classified under Weak Encoding for Password. CVSS score: 9.8/10. Published 2017-06-30.

How severe is CVE-2017-7905?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Ge Multilin Sr 369 Motor Protection Relay

CVE-2017-7905

A Weak Cryptography for Passwords issue was discovered in General Electric (GE) Multilin SR 750 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 760 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 469 Motor Protection Relay, firmware versions prior to Version 5.23; SR 489 Generator Protection Relay, firmware versions prior to Version 4.06; SR 745 Transformer Protection Relay, firmware versions prior to Version 5.23; SR 369 Motor Protection Relay, all firmware versions; Multilin Universal Relay, firmware Version 6.0 and prior versions; and Multilin URplus (D90, C90, B95), all versions. Ciphertext versions of user passwords were created with a non-random initialization vector leaving them susceptible to dictionary attacks. Ciphertext of user passwords can be obtained from the front LCD panel of affected products and through issued Modbus commands.

EPSS: 0.013 (68.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

References

ics-cert@hq.dhs.gov (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
ics-cert@hq.dhs.gov (US Government Resource, Patch, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2017-7905?: CVE-2017-7905 is a critical-severity vulnerability in Ge Multilin Sr 369 Motor Protection Relay, classified under Weak Encoding for Password. CVSS score: 9.8/10. Published 2017-06-30.
How severe is CVE-2017-7905?: Critical severity. CVSS v3 base score is 9.8 out of 10.