Riskcovery

CVE-2025-27257

State
Published
Severity
6.1 Medium
Published
Mar 10, 2025
Updated
Mar 12, 2025
Reserved
Feb 21, 2025

Read the record on cve.org

Description

Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware. The firmware signature verification is enforced only on the client-side dedicated software Enervista UR Setup, allowing the integration check to be bypassed.

Scores

CVSSScoreVectorSource
3.16.1 MediumCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:HNozomi

Weaknesses

  • CWE-345 Insufficient Verification of Data Authenticity

Affected Products

ProductVersions
N60 multilinGE Vernova
  • 7.0 through 8.60Affected
B30 MultilinGE Vernova
  • 7.0 through 8.60Affected
B90 MultilinGE Vernova
  • 7.0 through 8.60Affected
C30 MultilinGE Vernova
  • 7.0 through 8.60Affected
C60 MultilinGE Vernova
  • 7.0 through 8.60Affected
C70 MultilinGE Vernova
  • 7.0 through 8.60Affected
C95 MultilinGE Vernova
  • 7.0 through 8.60Affected
D30 MultilinGE Vernova
  • 7.0 through 8.60Affected
D60 MultilinGE Vernova
  • 7.0 through 8.60Affected
F35 MultilinGE Vernova
  • 7.0 through 8.60Affected
F60 MultilinGE Vernova
  • 7.0 through 8.60Affected
G30 MultilinGE Vernova
  • 7.0 through 8.60Affected
G60 MultilinGE Vernova
  • 7.0 through 8.60Affected
L30 MultilinGE Vernova
  • 7.0 through 8.60Affected
L60 MultilinGE Vernova
  • 7.0 through 8.60Affected
L90 MultilinGE Vernova
  • 7.0 through 8.60Affected
M60 MultilinGE Vernova
  • 7.0 through 8.60Affected
T35 MultilinGE Vernova
  • 7.0 through 8.60Affected
T60 MultilinGE Vernova
  • 7.0 through 8.60Affected
M60 MultilinGE Vernova
  • 7.0 through 8.60Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.