General Electric Renewable Energy MDS Radios

Risk Summary

Successful exploitation of these vulnerabilities could allow an attacker to control the configuration of the radio, join the network without proper authorization, or keep valid users from using the system correctly.

CVEs (6)

Remediations

• iNET/iNET II series radio firmware rev.8.3.0
• SD series radio firmware rev. 6.4.7
• TD220X series radio firmware rev. 2.0.16
• TD220MAX series radio firmware rev. 1.2.6
• GE also recommends the use of other protections inside the radio such as MAC address allow-listing, IEEE 802.1x authentication, or encrypt traffic at the application level with protocols such as HTTPS or SSH. GE provides additional mitigations and information about these vulnerabilities in GE publication number: GES-2021-18 TD220 - GES-2021-17 iNET - GES-2021-16

Affected Vendors

Affected Products (4)

Affected Sectors

Communications, Critical Manufacturing, Energy, Healthcare and Public Health, Transportation Systems, Water and Wastewater Systems