CVE-2022-24118

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-26 · updated 2026-06-17
Weakness: CWE-400

Description

Certain General Electric Renewable Energy products allow attackers to use a code to trigger a reboot into the factory default configuration. This affects iNET and iNET II before 8.3.0, SD before 6.4.7, TD220X before 2.0.16, and TD220MAX before 1.2.6.

Affected products

GE Inet 900 Firmware: before 8.3.0 — fixed in 8.3.0
GE Inet Ii 900 Firmware: before 8.3.0 — fixed in 8.3.0
GE Sd1 Firmware: through 6.4.7
GE Sd2 Firmware: before 6.4.7 — fixed in 6.4.7
GE Sd4 Firmware: before 6.4.7 — fixed in 6.4.7
GE Sd9 Firmware: before 6.4.7 — fixed in 6.4.7
GE Td220Max Firmware: before 1.2.6 — fixed in 1.2.6
GE Td220X Firmware: before 2.0.16 — fixed in 2.0.16

How to fix

Upgrade to a fixed version: GE Inet 900 Firmware 8.3.0; GE Inet Ii 900 Firmware 8.3.0; GE Sd2 Firmware 6.4.7; GE Sd4 Firmware 6.4.7; GE Sd9 Firmware 6.4.7; GE Td220Max Firmware 1.2.6; GE Td220X Firmware 2.0.16. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-24118 or the next vulnerability affects your stack