CVE-2015-6456

Published: Sep 18, 2015Modified: May 6, 2026

9.0

Vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability: 8.0 / Impact: 10.0

Source: NVD

Description

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 have hardcoded credentials for a support account, which allows remote attackers to obtain administrative access, and consequently execute arbitrary code, by leveraging knowledge of the password.

Affected (2)

Products: Ge: Mds Pulsenet

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Ge Mds Pulsenet	Up to 3.1.3
Ge Mds Pulsenet	Up to 3.1.3

References (6)

http://www.gedigitalenergy.com/app/resources.aspx?prod=pulsenet&type=9

Source: ics-cert@hq.dhs.gov

Vendor Advisory

http://zerodayinitiative.com/advisories/ZDI-15-440/

Source: ics-cert@hq.dhs.gov

https://ics-cert.us-cert.gov/advisories/ICSA-15-258-03

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

http://www.gedigitalenergy.com/app/resources.aspx?prod=pulsenet&type=9

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://zerodayinitiative.com/advisories/ZDI-15-440/

Source: af854a3a-2127-422b-91ae-364da2661108

https://ics-cert.us-cert.gov/advisories/ICSA-15-258-03

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.