CVE-2014-5409

GE Hydran M2 Predictable Value Range from Previous Values

State: Published
Severity: 6.4 Medium
Published: Mar 14, 2015
Updated: Nov 3, 2025
Reserved: Aug 22, 2014

Description

The 17046 Ethernet card before 94450214LFMT100SEM-L.R3-CL for the GE Digital Energy Hydran M2 does not properly generate random values for TCP Initial Sequence Numbers (ISNs), which makes it easier for remote attackers to spoof packets by predicting these values.

Scores

CVSS	Score	Vector	Source
2.0	6.4 Medium	AV:N/AC:L/Au:N/C:P/I:N/A:P	icscert

Weaknesses

CWE-343

Affected Products

Product	Versions
Hydran M2, containing the 17046 Ethernet optionGE	before October 2014Affected

References

https://www.cisa.gov/news-events/ics-advisories/icsa-15-041-02
http://libraries.ge.com/download?fileid=642886573101&entity_id=31955841101&sid=101
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-041-02.json
https://ics-cert.us-cert.gov/advisories/ICSA-15-041-02

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.