CVE-2020-12017

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-06-02 · updated 2026-06-17
Weakness: CWE-306

Description

GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute arbitrary commands and send a request to a specific URL that could cause the device to become unresponsive. The unauthenticated attacker may change the password of the 'configuration' user account, allowing the attacker to modify the configuration of the device via the web interface using the new password. This vulnerability may also allow an unauthenticated attacker to bypass the authentication required to configure the device and reboot the system.

Affected products

GE Rt430 Firmware: before 08a05 — fixed in 08a05
GE Rt431 Firmware: before 08a05 — fixed in 08a05
GE Rt434 Firmware: before 08a05 — fixed in 08a05

How to fix

Upgrade to a fixed version: GE Rt430 Firmware 08a05; GE Rt431 Firmware 08a05; GE Rt434 Firmware 08a05. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-12017 or the next vulnerability affects your stack