CVE-2022-24116

Published: Dec 26, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Certain General Electric Renewable Energy products have inadequate encryption strength. This affects iNET and iNET II before 8.3.0.

Affected (8)

Products: Ge: Inet 900 Firmware, Inet Ii 900 Firmware, Sd1 Firmware, Sd2 Firmware, Sd4 Firmware, Sd9 Firmware, Td220max Firmware, Td220x Firmware

8 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Inet 900 Firmware	Before 8.3.0

Running on/with	Platform Versions
Ge Inet 900	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Inet Ii 900 Firmware	Before 8.3.0

Running on/with	Platform Versions
Ge Inet Ii 900	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Sd1 Firmware	Up to 6.4.7

Running on/with	Platform Versions
Ge Sd1	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Sd2 Firmware	Before 6.4.7

Running on/with	Platform Versions
Ge Sd2	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Sd4 Firmware	Before 6.4.7

Running on/with	Platform Versions
Ge Sd4	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Sd9 Firmware	Before 6.4.7

Running on/with	Platform Versions
Ge Sd9	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Td220max Firmware	Before 1.2.6

Running on/with	Platform Versions
Ge Td220max	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Td220x Firmware	Before 2.0.16

Running on/with	Platform Versions
Ge Td220x	All versions

Related CWEs

CWE-325

Missing Cryptographic Step

The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.

CWE-326

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

References (2)

https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-06

Source: cve@mitre.org

PatchThird Party AdvisoryUS Government Resource

https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-06

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party AdvisoryUS Government Resource

Timeline

No history available yet.