GE Multilin SR, UR, and URplus Protective Relays (Update B)

Risk Summary

ATTENTION: Remotely exploitable/low skill level to exploit.

CVEs (1)

Remediations

• GE's download link for 760 Feeder Protection Relay, Version 7.47 is as follows:
• GE's download link for 750 Feeder Protection Relay, Version 7.47 is as follows (login required):
• GE's download link for 745 Transformer Protection Relay, Version 5.23 is as follows (login required):
• GE's download link for 489 Generator Protection Relay, Version 4.06 is as follows (login required):
• GE's download link for 469 Motor Protection Relay, Version 5.23 is as follows (login required):
• GE's download link for 369 Motor Protection Relay, Version 3.63 is as follows (login required):
• GE security advisory, UR-2017-00001 Multilin UR/URPlus Family of Protective Relays, is available at the following location, with a valid account:
• GE had identified additional legacy products that have the same vulnerability as the SR protective relays and in response, has released the following updated firmware versions:
• GE's download link for the MM300 Motor Management Relay, firmware Version 1.71 is as follows (login required):
• GE's release notification is as follows:
• GE's download link for the MM200 Motor Management System, firmware Version 1.25 is as follows (login required):
• MX350 Relay, firmware versions prior to Version 1.27,
• For more information about the availability of this firmware version, contact GE's support:
• RPTCS, firmware versions prior to Version 1.29,
• GE's download link for the 350 Feeder Protection Relay, firmware Version 2.30 is as follows (login required):
• GE's download link for the 345 Transformer Protection Relay, firmware Version 2.30, is as follows (login required):
• GE's download link for the 339 Motor Protection Relay, firmware Version 2.30, is as follows (login required):
• GE's download link for the T1000 Switch, firmware Version 03A02 is as follows (login required):
• GE UR firmware versions 7.xx are not affected. GE has released updates that remove the ability to obtain the password cipher text in the following firmware versions:
• Universal Relay: firmware Version 5.83
• Universal Relay: firmware Version 5.92
• Universal Relay: firmware Version 6.02 to 6.05
• The Universal Relay firmware is available at the following location:
• GE reports that the URplus platform will have firmware updates released in July 2017 for the following product versions:
• URplus: firmware Version 1.86
• URplus: firmware Version 1.92
• B95Plus: firmware Version 1.03
• GE recommends that users apply updated firmware versions to affected products, as well as implement the following physical security and network security defensive measures:
• Control access to affected products by keeping devices in a locked and secure environment,
• Remove passwords when decommissioning devices,
• Monitor and block malicious network activity, and
• Implement appropriate network segmentation and place affected devices within the control system network, behind properly configured firewalls. Protection and Control system devices should not be directly connected to the Internet or business networks.
• GE security advisory, SR-2017-00001 Multilin SR Family of Protective Relays, is available at the following location, with a valid account:

Affected Vendors

Affected Products (28)

Affected Sectors

Chemical, Critical Manufacturing, Dams, Energy, Food and Agriculture, Government Facilities, Transportation Systems, Water and Wastewater Systems