What’s Vulnerable › Vulnerabilities

CVE-2014-5409: GE Hydran M2 Predictable Value Range from Previous Values

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2015-03-14 · updated 2026-06-17
• Weakness: CWE-343

Description

The 17046 Ethernet card before 94450214LFMT100SEM-L.R3-CL for the GE Digital Energy Hydran M2 does not properly generate random values for TCP Initial Sequence Numbers (ISNs), which makes it easier for remote attackers to spoof packets by predicting these values.

Affected products

• GE Hydran M2, containing the 17046 Ethernet option: all versions

References

• http://libraries.ge.com/download?fileid=642886573101&entity_id=31955841101&sid=101
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-041-02.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-15-041-02
• http://libraries.ge.com/download?fileid=642886573101&entity_id=31955841101&sid=101
• https://ics-cert.us-cert.gov/advisories/ICSA-15-041-02

Get alerted when CVE-2014-5409 or the next vulnerability affects your stack