Hard-coded credentials in GE Communicator
Priority MEDIUM 45CWE-798Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-798.
Summary
GE Communicator, all versions prior to 4.0.517, contains two backdoor accounts with hardcoded credentials, which may allow control over the database. This service is inaccessible to attackers if Windows default firewall settings are used by the end user.
Why it matters now
EPSS 0.01277 70th percentileScored 2026-11-07
Fix Fixed GE Communicator: 4.0.517
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | GE Communicator | before 4.0.517 | 4.0.517 | Patch available | CNA |
- GE Communicator Vendor— Affected before 4.0.517 Fixed in 4.0.517 Patch available CNA
Remediation
- Fix · CNA GE Communicator Fixed in 4.0.517
Timeline
- 2026-10-02 Threatist record created from CVE-2019-6548
- 2026-10-03 Alias added: GHSA-w27f-jh8g-p7vw
References
More Ge Communicator vulnerabilities
- TI-2019-04600 Uncontrolled search path in GE Communicator CVSS 3.1HIGH 7.8
- TI-2017-05517 Heap-based buffer overflow in GE Communicator CVSS 3.0HIGH 7.6
- TI-2019-04620 Improper access control in GE Communicator CVSS 3.1HIGH 7.8
- TI-2019-04618 Uncontrolled search path in GE Communicator CVSS 3.1HIGH 7.8
- TI-2019-04598 Improper access control in GE Communicator CVSS 3.1MEDIUM 5.6
Sources
- CVE-2019-6548 · CVE Program
- CVE-2019-6548 · NVD
- FIRST EPSS
- GHSA-w27f-jh8g-p7vw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences