Vulnerability Report

CVE-2017-7905

Title: Ge Multilin Sr 750 Feeder Protection Relay Cryptographic Failures

Other

Proof Of Concept

No public PoC currently indexed for CVE-2017-7905.

CWE Category CWE-326

Published Date Jun 30, 2017

Modified Date Jun 17, 2026

Exploit Status Not Found

Score 9.8 CVSS v3.0

Exploit Probability (EPSS)

1.28%

Vulnerability Summary

CVE-2017-7905: A Weak Cryptography for Passwords issue was discovered in General Electric (GE) Multilin SR 750 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 760 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 469 Motor Protection Relay, firmware versions prior to Version 5.23; SR 489 Generator Protection Relay, firmware versions prior to Version 4.06; SR 745 Transformer Protection Relay, firmware versions prior to Version 5.23; SR 369 Motor Protection Relay, all firmware versions; Multilin Universal Relay, firmware Version 6.0 and prior versions; and Multilin URplus (D90, C90, B95), all versions. Ciphertext versions of user passwords were created with a non-random initialization vector leaving them susceptible to dictionary attacks. Ciphertext of user passwords can be obtained from the front LCD panel of affected products and through issued Modbus commands.

Impacted Vendors

ge 10

Reference Links

http://www.securityfocus.com/bid/98063 https://ics-cert.us-cert.gov/advisories/ICSA-17-117-01A http://www.securityfocus.com/bid/98063 https://ics-cert.us-cert.gov/advisories/ICSA-17-117-01A

CVSS v3.0

Source Entity [email protected]

Severity CRITICAL

9.8

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

5.0

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:N/C:P/I:N/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns