N/A

GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute arbitrary commands and send a request to a specific URL that could cause the device to become unresponsive. The unauthenticated attacker may change the password of the 'configuration' user account, allowing the attacker to modify the configuration of the device via the web interface using the new password. This vulnerability may also allow an unauthenticated attacker to bypass the authentication required to configure the device and reboot the system.

N/A

关键功能的认证机制缺失

多款GE产品访问控制错误漏洞

GE Grid Solutions Reason RT Clocks RT430等都是美国通用电气（GE）公司的一款精密时间同步单元。 多款GE产品中存在访问控制错误漏洞。攻击者可借助特制请求利用该漏洞执行任意命令，造成设备无法响应，更改密码，修改设备配置或绕过身份验证，重启系统。以下产品及版本受到影响：使用08A05之前版本固件的GE Grid Solutions Reason RT Clocks；使用08A05之前版本固件的GE Grid Solutions Reason RT430；使用08A05之

N/A

N/A