What’s Vulnerable › Vulnerabilities

CVE-2025-27257

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-10 · updated 2026-06-17
• Weakness: CWE-345

Description

Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware. The firmware signature verification is enforced only on the client-side dedicated software Enervista UR Setup, allowing the integration check to be bypassed.

Affected products

• GE Vernova B30 Multilin: from 7.0 through 8.60
• GE Vernova B90 Multilin: from 7.0 through 8.60
• GE Vernova C30 Multilin: from 7.0 through 8.60
• GE Vernova C60 Multilin: from 7.0 through 8.60
• GE Vernova C70 Multilin: from 7.0 through 8.60
• GE Vernova C95 Multilin: from 7.0 through 8.60
• GE Vernova D30 Multilin: from 7.0 through 8.60
• GE Vernova D60 Multilin: from 7.0 through 8.60
• GE Vernova F35 Multilin: from 7.0 through 8.60
• GE Vernova F60 Multilin: from 7.0 through 8.60
• GE Vernova G30 Multilin: from 7.0 through 8.60
• GE Vernova G60 Multilin: from 7.0 through 8.60
• GE Vernova L30 Multilin: from 7.0 through 8.60
• GE Vernova L60 Multilin: from 7.0 through 8.60
• GE Vernova L90 Multilin: from 7.0 through 8.60
• GE Vernova M60 Multilin: from 7.0 through 8.60
• GE Vernova N60 multilin: from 7.0 through 8.60
• GE Vernova T35 Multilin: from 7.0 through 8.60
• GE Vernova T60 Multilin: from 7.0 through 8.60

References

• https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76
• https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27257

Get alerted when CVE-2025-27257 or the next vulnerability affects your stack