What’s Vulnerable › Vulnerabilities

CVE-2022-24117

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-12-26 · updated 2026-06-17
• Weakness: CWE-494

Description

Certain General Electric Renewable Energy products download firmware without an integrity check. This affects iNET and iNET II before 8.3.0, SD before 6.4.7, TD220X before 2.0.16, and TD220MAX before 1.2.6.

Affected products

• GE Inet 900 Firmware: before 8.3.0 — fixed in 8.3.0
• GE Inet Ii 900 Firmware: before 8.3.0 — fixed in 8.3.0
• GE Sd1 Firmware: through 6.4.7
• GE Sd2 Firmware: before 6.4.7 — fixed in 6.4.7
• GE Sd4 Firmware: before 6.4.7 — fixed in 6.4.7
• GE Sd9 Firmware: before 6.4.7 — fixed in 6.4.7
• GE Td220Max Firmware: before 1.2.6 — fixed in 1.2.6
• GE Td220X Firmware: before 2.0.16 — fixed in 2.0.16

How to fix

Upgrade to a fixed version: GE Inet 900 Firmware 8.3.0; GE Inet Ii 900 Firmware 8.3.0; GE Sd2 Firmware 6.4.7; GE Sd4 Firmware 6.4.7; GE Sd9 Firmware 6.4.7; GE Td220Max Firmware 1.2.6; GE Td220X Firmware 2.0.16. Check the vendor advisory for mitigations.

References

• https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-06
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-06

Get alerted when CVE-2022-24117 or the next vulnerability affects your stack