What’s Vulnerable › Vulnerabilities

CVE-2022-24120

• Severity: medium (CVSS 4.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-12-26 · updated 2026-06-17
• Weakness: CWE-312

Description

Certain General Electric Renewable Energy products store cleartext credentials in flash memory. This affects iNET and iNET II before 8.3.0.

Affected products

• GE Inet 900 Firmware: before 8.3.0 — fixed in 8.3.0
• GE Inet Ii 900 Firmware: before 8.3.0 — fixed in 8.3.0
• GE Sd1 Firmware: through 6.4.7
• GE Sd2 Firmware: before 6.4.7 — fixed in 6.4.7
• GE Sd4 Firmware: before 6.4.7 — fixed in 6.4.7
• GE Sd9 Firmware: before 6.4.7 — fixed in 6.4.7
• GE Td220Max Firmware: before 1.2.6 — fixed in 1.2.6
• GE Td220X Firmware: before 2.0.16 — fixed in 2.0.16

How to fix

Upgrade to a fixed version: GE Inet 900 Firmware 8.3.0; GE Inet Ii 900 Firmware 8.3.0; GE Sd2 Firmware 6.4.7; GE Sd4 Firmware 6.4.7; GE Sd9 Firmware 6.4.7; GE Td220Max Firmware 1.2.6; GE Td220X Firmware 2.0.16. Check the vendor advisory for mitigations.

References

• https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-06
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-06

Get alerted when CVE-2022-24120 or the next vulnerability affects your stack