What’s Vulnerable › Vulnerabilities

CVE-2025-27254

• Severity: high (CVSS 8.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-10 · updated 2026-06-17
• Weakness: CWE-282

Description

CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass.  The software's startup authentication can be disabled by altering a Windows registry setting that any user can modify.

Affected products

• GE Vernova EnerVista UR Setup: 8.42

References

• https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76
• https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27254

Get alerted when CVE-2025-27254 or the next vulnerability affects your stack