CVE-2022-24116

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-26 · updated 2026-06-17
Weakness: CWE-326

Description

Certain General Electric Renewable Energy products have inadequate encryption strength. This affects iNET and iNET II before 8.3.0.

Affected products

GE Inet 900 Firmware: before 8.3.0 — fixed in 8.3.0
GE Inet Ii 900 Firmware: before 8.3.0 — fixed in 8.3.0
GE Sd1 Firmware: through 6.4.7
GE Sd2 Firmware: before 6.4.7 — fixed in 6.4.7
GE Sd4 Firmware: before 6.4.7 — fixed in 6.4.7
GE Sd9 Firmware: before 6.4.7 — fixed in 6.4.7
GE Td220Max Firmware: before 1.2.6 — fixed in 1.2.6
GE Td220X Firmware: before 2.0.16 — fixed in 2.0.16

How to fix

Upgrade to a fixed version: GE Inet 900 Firmware 8.3.0; GE Inet Ii 900 Firmware 8.3.0; GE Sd2 Firmware 6.4.7; GE Sd4 Firmware 6.4.7; GE Sd9 Firmware 6.4.7; GE Td220Max Firmware 1.2.6; GE Td220X Firmware 2.0.16. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-24116 or the next vulnerability affects your stack