CVE-2025-27257

MEDIUM
2025-03-10 [email protected]
RCE
6.1
CVSS 3.1
Share

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 19:50 vuln.today
CVE Published
Mar 10, 2025 - 09:15 nvd
MEDIUM 6.1

DescriptionNVD

Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware. The firmware signature verification is enforced only on the client-side dedicated software Enervista UR Setup, allowing the integration check to be bypassed.

AnalysisAI

GE Vernova UR IED family devices is affected by insufficient verification of data authenticity (CVSS 6.1).

Technical ContextAI

This vulnerability (CWE-345: Insufficient Verification of Data Authenticity) affects GE Vernova UR IED family devices. Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware. The firmware signature verification is enforced only on the client-side dedicated software Enervista UR Setup, allowing the integration check to be bypassed.

Affected ProductsAI

Product: GE Vernova UR IED family devices.

RemediationAI

Monitor vendor advisories for a patch.

Share

CVE-2025-27257 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy