VulnerabilityModified

CVE-2021-27426

GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a “Factory” user.

CRITICAL 9.8EPSS 1.21%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.21%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.21% probability · 68th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-453
Affected: ge/multilin b30 firmware · ge/multilin b90 firmware · ge/multilin c60 firmware · ge/multilin c70 firmware · ge/multilin c95 firmware · ge/multilin d30 firmware · ge/multilin d60 firmware · ge/multilin f35 firmware · ge/multilin f60 firmware · ge/multilin g30 firmware · ge/multilin g60 firmware · ge/multilin l30 firmware · ge/multilin l60 firmware · ge/multilin l90 firmware · ge/multilin m60 firmware · ge/multilin n60 firmware · ge/multilin t35 firmware · ge/multilin t60 firmware · ge/multilin c30 firmware
Source: ics-cert@hq.dhs.gov

EPSS trend

EPSS 1.2% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02Mitigation, Third Party Advisory, US Government Resource
https://www.gegridsolutions.com/Passport/Login.aspxPermissions Required, Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02Mitigation, Third Party Advisory, US Government Resource
https://www.gegridsolutions.com/Passport/Login.aspxPermissions Required, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.