TI-2014-04409 Aliases CVE-2014-5409 GHSA-w7hr-2cw5-qqgq

GE Hydran M2 Predictable Value Range from Previous Values

LOW 34CWE-343Published 2015-03-14 · Updated 2025-11-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Partial · None · Partial
Fix status: Fixed

Attack profile from CVSS 2.0 · CNA. Fix status from CNA.

Summary

The 17046 Ethernet card before 94450214LFMT100SEM-L.R3-CL for the GE Digital Energy Hydran M2 does not properly generate random values for TCP Initial Sequence Numbers (ISNs), which makes it easier for remote attackers to spoof packets by predicting these values.

Why it matters now

EPSS 0.02718 86th percentileScored 2026-11-07

Fix Fixed Hydran M2, containing the 17046 Ethernet option (GE): October 2014

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
GE	Hydran M2, containing the 17046 Ethernet option	before October 2014	October 2014	Patch available	CNA

Hydran M2, containing the 17046 Ethernet option VendorGE Affected before October 2014 Fixed in October 2014 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:h:ge:hydran_m2::::::::	all versions	Vulnerable	GE

cpe:2.3:h:ge:hydran_m2:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·GE

Remediation

Fix · CNA Hydran M2, containing the 17046 Ethernet option (GE) Fixed in October 2014

Timeline

2026-10-02 Threatist record created from CVE-2014-5409
2026-10-03 Alias added: GHSA-w7hr-2cw5-qqgq

References

Advisory 1

https://ics-cert.us-cert.gov/advisories/ICSA-15-041-02

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences