CVE-2022-24117

Published: Dec 26, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Certain General Electric Renewable Energy products download firmware without an integrity check. This affects iNET and iNET II before 8.3.0, SD before 6.4.7, TD220X before 2.0.16, and TD220MAX before 1.2.6.

Affected (8)

Products: Ge: Inet 900 Firmware, Inet Ii 900 Firmware, Sd1 Firmware, Sd2 Firmware, Sd4 Firmware, Sd9 Firmware, Td220max Firmware, Td220x Firmware

8 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Inet 900 Firmware	Before 8.3.0

Running on/with	Platform Versions
Ge Inet 900	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Inet Ii 900 Firmware	Before 8.3.0

Running on/with	Platform Versions
Ge Inet Ii 900	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Sd1 Firmware	Up to 6.4.7

Running on/with	Platform Versions
Ge Sd1	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Sd2 Firmware	Before 6.4.7

Running on/with	Platform Versions
Ge Sd2	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Sd4 Firmware	Before 6.4.7

Running on/with	Platform Versions
Ge Sd4	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Sd9 Firmware	Before 6.4.7

Running on/with	Platform Versions
Ge Sd9	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Td220max Firmware	Before 1.2.6

Running on/with	Platform Versions
Ge Td220max	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Td220x Firmware	Before 2.0.16

Running on/with	Platform Versions
Ge Td220x	All versions

Related CWEs

CWE-494

Download of Code Without Integrity Check

The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

References (2)

https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-06

Source: cve@mitre.org

PatchThird Party AdvisoryUS Government Resource

https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-06

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party AdvisoryUS Government Resource

Timeline

No history available yet.