What’s Vulnerable › Vulnerabilities

CVE-2025-27253

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-10 · updated 2026-06-17
• Weakness: CWE-15

Description

A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to bypass firewall rules or to send malicious traffic in the network.

Affected products

• GE Vernova B30 Multilin: from 7.0 through 8.60
• GE Vernova B90 Multilin: from 7.0 through 8.60
• GE Vernova C30 Multilin: from 7.0 through 8.60
• GE Vernova C60 Multilin: from 7.0 through 8.60
• GE Vernova C70 Multilin: from 7.0 through 8.60
• GE Vernova C95 Multilin: from 7.0 through 8.60
• GE Vernova D30 Multilin: from 7.0 through 8.60
• GE Vernova D60 Multilin: from 7.0 through 8.60
• GE Vernova F35 Multilin: from 7.0 through 8.60
• GE Vernova F60 Multilin: from 7.0 through 8.60
• GE Vernova G30 Multilin: from 7.0 through 8.60
• GE Vernova G60 Multilin: from 7.0 through 8.60
• GE Vernova L30 Multilin: from 7.0 through 8.60
• GE Vernova L60 Multilin: from 7.0 through 8.60
• GE Vernova L90 Multilin: from 7.0 through 8.60
• GE Vernova M60 Multilin: from 7.0 through 8.60
• GE Vernova N60 multilin: from 7.0 through 8.60
• GE Vernova T35 Multilin: from 7.0 through 8.60
• GE Vernova T60 Multilin: from 7.0 through 8.60

References

• https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76
• https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27253

Get alerted when CVE-2025-27253 or the next vulnerability affects your stack