Read the docs
TI-2019-04600 Aliases CVE-2019-6546GHSA-9hx4-972h-83x2

Uncontrolled search path in GE Communicator

Priority LOW 36CWE-427Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-427.

Summary

GE Communicator, all versions prior to 4.0.517, allows an attacker to place malicious files within the working directory of the program, which may allow an attacker to manipulate widgets and UI elements.

Why it matters now

EPSS 0.00835 57th percentileScored 2026-11-07
Fix Fixed GE Communicator: 4.0.517

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—GE Communicatorbefore 4.0.5174.0.517Patch availableCNA
  • GE Communicator Vendor— Affected before 4.0.517 Fixed in 4.0.517 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ge:ge_communicator:*:*:*:*:*:*:*:*before 4.0.517VulnerableGE
  • cpe:2.3:a:ge:ge_communicator:*:*:*:*:*:*:*:* Versions before 4.0.517 Vulnerable ·GE

Remediation

  • Fix · CNA GE Communicator Fixed in 4.0.517

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-6546
  2. 2026-10-03 Alias added: GHSA-9hx4-972h-83x2

References

Advisory 1

  • TI-2019-04602 Hard-coded credentials in GE Communicator CVSS 3.1CRITICAL 9.8
  • TI-2017-05517 Heap-based buffer overflow in GE Communicator CVSS 3.0HIGH 7.6
  • TI-2019-04620 Improper access control in GE Communicator CVSS 3.1HIGH 7.8
  • TI-2019-04618 Uncontrolled search path in GE Communicator CVSS 3.1HIGH 7.8
  • TI-2019-04598 Improper access control in GE Communicator CVSS 3.1MEDIUM 5.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences