Description (CNA)
GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting attacks, which may be used to send a malicious script. Also, UR Firmware web server does not perform HTML encoding of user-supplied strings.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| GE / UR family | affected unspecified before 8.1x |
CWE
CWE-20
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02
- https://www.gegridsolutions.com/Passport/Login.aspx
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.